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The  EPA  released  the  interim  final  Response  Protocol  Toolbox:  Planning  for  and  Responding  to 
Drinking  Water  Contamination  Threats  and  Incidents  (the  Response  Protocol  Toolbox)  in  winter 
of  2003  and  spring  of  2004  to  help  the  water  sector  effectively  and  appropriately  plan  for  and 
respond  to  contamination  threats  and  incidents.  Since  its  release,  EPA  has  received  feedback  and 
suggestions  from  several  sources  concerning  improvements  in  the  Response  Protocol  Toolbox. 
These  Response  Guidelines  have  been  developed  to  provide  an  easy  to  use  document  for  field 
and  crisis  conditions.  While  the  Response  Protocol  Toolbox  provides  detailed  information,  the 
Response  Guidelines  are  to  be  viewed  as  the  application  of  the  same  principles  during  an  actual 
incident. 

As  stated  in  the  definition  of  Response  Guidelines  in  Module  1,  Section  4.3  of  the  Response 
Protocol  Toolbox,  Response  Guidelines  are  different  from  an  Emergency  Response  Plan  in  that 
they  are  essentially  a  “field  guide”  for  responding  to  contamination  threats  and  can  be  developed 
in  many  different  formats. 

This  document  is  intended  to  be  an  action  oriented  document  to  assist  drinking  water  utilities, 
laboratories,  emergency  responders,  state  drinking  water  programs,  technical  assistance 
providers,  and  public  health  and  law  enforcement  officials  during  the  management  of  an  ongoing 
contamination  threat  or  incident.  The  Response  Guidelines  are  derived  from  the  content  of  the 
six  full  modules  of  the  Response  Protocol  Toolbox. 

The  Response  Guidelines  are  not  intended  to  replace  the  Response  Protocol  Toolbox  and  they  do 
not  contain  the  detailed  information  contained  within  the  six  complete  modules.  Einally,  users 
are  encouraged  to  adapt  the  Response  Guidelines  as  necessary  to  meet  their  own  needs  and 
objectives. 
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Communications  and  Notifications 

Initial  Notifications 


'Possible'  stage  evaluation  by  utility 


'Credible'  stage  evaluation  by  utility 


'Credible'  stage  evaluation  by  unified  command 


'Confirmed'  stage  evaluation  by  unified  command 
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1.2  Contact  List 


TO  BE  CO 

MPLETED 

Agency 

Name 

Location 

Phone 

E-mail 
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Threat  Evaluation 

Threat  Evaluation  Process 
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2.2  Evaluating  Threat  Warnings 

The  first  critical  step  in  evaluating  a  contamination  threat  is  recognition  of  a  threat  warning  (i.e., 
an  unusual  situation  that  may  have  presented  the  opportunity  for  contamination  of  the  drinking 
water).  The  utility  will  likely  be  in  the  best  position  to  observe  a  threat  warning  and  evaluate 
whether  or  not  the  activity  is  suspicious  (i.e.,  first  decision  point  in  the  Threat  Evaluation 
process).  This  section  briefly  describes  factors  to  consider  when  evaluating  various  types  of 
threat  warnings. 

The  common  types  of  threat  warnings  include: 

•  Security  breaches:  A  security  breach  is  an  unauthorized  intrusion  into  a  secured  facility 
that  may  be  discovered  through  direct  observation,  an  alarm  trigger,  or  signs  of  intrusion 
(e.g.,  cut  locks,  open  doors,  cut  fences).  Security  breaches  may  be  the  most  common 
threat  warnings,  but  in  most  cases  are  related  to  day-to-day  operation  and  maintenance 
within  the  water  system.  Other  security  breaches  may  be  due  to  criminal  activity  such  as 
trespassing,  vandalism,  and  theft  rather  than  attempts  to  contaminate  the  water. 

o  Security  Incident  Report  Form  Section  2.4 

•  Witness  account:  A  threat  warning  may  come  from  an  individual  who  directly  witnesses 
suspicious  activity,  such  as  trespassing,  breaking  and  entering,  or  some  other  form  of 
tampering.  The  witness  could  be  a  utility  employee,  law  enforcement  officer,  citizen,  etc. 

o  Witness  Account  Report  Form  Section  2.5 

•  Direct  notification  by  perpetrator:  A  threat  may  be  made  directly,  verbally  or  in 
writing,  to  the  water  utility,  the  news  media,  law  enforcement,  or  a  government  agency. 
Verbal  threats  made  over  the  phone  are  historically  the  most  common  type  of  direct 
threats  from  perpetrators;  however,  there  have  also  been  written  threats  to  contaminate 
the  drinking  water  supply. 

o  Phone  Threat  Report  Form  Section  2.6 

o  Written  Threat  Report  Form  Section  2.7 

•  Unusual  water  quality  or  consumer  complaints:  Unusual  water  quality  results  or  an 
unexplained  or  unusually  high  incidence  of  consumer  complaints  may  serve  as  a  warning 
of  potential  contamination.  In  order  to  evaluate  this  type  of  warning,  it  will  be  necessary 
to  carefully  track  routinely  monitored  water  quality  data  and/or  consumer  complaints 
such  that  significant  deviations  from  an  established  baseline  might  be  observed. 

o  Water  Quality  and  Consumer  Complaints  Report  Form  Section  2.8 

•  Notification  by  public  health  agency:  Notification  from  a  public  health  agency 
regarding  increased  incidence  of  disease  or  death  is  another  possible  threat  warning.  A 
threat  triggered  by  a  public  health  notification  is  unique  in  that  at  least  a  segment  of  the 
population  has  presumably  been  exposed  to  a  harmful  substance.  In  this  case,  public 
health  officials  may  launch  an  epidemiological  investigation  in  an  attempt  to  identify  the 
source  of  the  outbreak,  during  which  the  utility  may  be  expected  to  play  a  support  role. 

o  Public  Health  Information  Report  Form  Section  2.9 


7 


Interim  Einal  -  August  2004 


RESPONSE  GUIDELINES 


2.3  Threat  Evaluation  Worksheet 

INSTRUCTIONS 

The  purpose  of  this  worksheet  is  to  heip  organize  information  about  a  contamination  threat  warning  that 
wouid  be  used  during  the  Threat  Evaiuation  Process.  The  individuai  responsibie  for  conducting  the 
Threat  Evaiuation  (e.g.,  the  WUERM)  shouid  compiete  this  worksheet.  The  worksheet  is  generic  to 
accommodate  information  from  different  types  of  threat  warnings;  thus,  there  wiii  iikeiy  be  information  that 
is  unavaiiabie  or  not  immediateiy  avaiiabie.  Other  forms  in  the  Appendices  are  provided  to  augment  the 
information  in  this  worksheet. 


THREAT  WARNING  INFORMATION 

Date/Time  threat  warning  discovered:  _ 

Utility  Name  and  Address:  _ 

Name/Number  of  person  who  discovered  threat  warning:  _ 

Type  of  threat  warning: 

□  Security  breach  □  Witness  account  □  Phone  threat 

□  Written  threat  □  Unusual  water  quality  □  Consumer  complaints 

□  Public  health  notification  □  Other  _ 

Identity  of  the  contaminant:  □  Known  □  Suspected  □  Unknown 

If  known  or  suspected,  provide  additionai  detaii  beiow 

□  Chemical  □  Biological  □  Radiological 

Describe  _ 


Time  of  contamination:  □  Known  □  Estimated  □  Unknown 

If  known  or  estimated,  provide  additionai  detaii  beiow 

Date  and  time  of  contamination:  _ 

Additional  Information:  _ 


Mode  of  contamination:  □  Known  □  Suspected  □  Unknown 

If  known  or  suspected,  provide  additionai  detaii  beiow 

Method  of  addition:  □  Single  dose  □  Overtime  □  Other  _ 

Amount  of  material:  _ 

Additional  Information:  _ 
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Site  of  contamination:  □  Known  □  Suspected  □  Unknown 

If  known  or  suspected,  provide  additional  detail  below 

Number  of  sites:  _ 

Provide  the  following  information  for  each  site. 

Site  #1 

Site  Name:  _ 


Type  of  facility 

□  Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additionai  Site  Information: 


Site  #2 

Site  Name: 


Type  of  facility 

□  Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additionai  Site  Information: 


Site  #3 

Site  Name: 


Type  of  facility 

□  Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additional  Site  Information: 
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ADDITIONAL  INFORMATION 

Has  there  been  a  breach  of  security  at  the  suspected  site?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Security  Incident  Report’  (Section  2.4) 

Are  there  any  witness  accounts  of  the  suspected  incident?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Witness  Account  Report’  (Section  2.5) 

Was  the  threat  made  verbally  over  the  phone?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Phone  Threat  Report’  (Section  2.6) 

Was  a  written  threat  received?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Written  Threat  Report’  (Section  2.7) 

Are  there  unusual  water  quality  data  or  consumer  complaints?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Water  Quality/Consumer  Complaint  Report’  (Section  2.8) 

Are  there  unusual  symptoms  or  disease  in  the  population?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Public  Health  Report’  (Section  2.9) 

Is  a  ‘Site  Characterization  Report’  available?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Site  Characterization  Report’  (Section  3.4) 

Are  results  of  sample  analysis  available?  □  Yes  □  No 

If  “Yes”,  review  the  analytical  results  report,  including  appropriate  QA/QC  data 

Is  a  ‘Contaminant  Identification  Report’  available?  □  Yes  □  No 

If  “Yes”,  review  the  completed  ‘Sample  Analysis  Report’  (Section  4.3) 

Is  there  relevant  information  available  from  external  sources?  □  Yes  □  No 

Check  all  that  apply 


□ 

Locai  iaw  enforcement 

□ 

FBI 

□ 

DW  primacy  agency 

□ 

Pubiic  heaith  agency 

□ 

Hospitais  /  91 1  caii  centers 

□ 

US  EPA  /  Water  ISAC 

□ 

□ 

Media  reports 

Other 

□ 

Homeland  security  alerts 

□ 

Neighboring  utilities 

Point  of  Contact: 


Summary  of  key  information  from  externai  sources  (provide  detaii  in  attachments  as  necessary): 
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Response  to  a  confirmed  incident: 

□  Sample  analysis  □  Site  characterization  □  Isolation/containment 

□  Full  EOC  activation  □  Public  notification  □  Provide  alternate  water  supply 

□  Initiate  remediation  and  recovery 

□  Other  _ 
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How  do  other  organizations  characterize  the  threat? 


Organization 

Evaiuation 

Comment 

□  Local  Law 
Enforcement 

□  Possible 

□  Credible 

□  Confirmed 

□  FBI 

□  Possible 

□  Credible 

□  Confirmed 

□  Public  Health 
Agency 

□  Possible 

□  Credible 

□  Confirmed 

□  Drinking  Water 
Primacy  Agency 

□  Possible 

□  Credible 

□  Confirmed 

□  Other 

□  Possible 

□  Credible 

□  Confirmed 

□  Other 

□  Possible 

□  Credible 

□  Confirmed 

SiGNOFF 

Name  of  person  completing  this  form: 

Print  name  _  Phone  Number  _ 

Signature  _  Date/Time: 
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2.4  Security  Incident  Report  Form 

INSTRUCTIONS 

The  purpose  of  this  form  is  to  heip  organize  information  about  a  security  incident,  typicaiiy  a  security 
breach,  which  may  be  reiated  to  a  water  contamination  threat.  The  individuai  who  discovered  the  security 
incident,  such  as  a  security  supervisor,  the  WUERM,  or  another  designated  individuai  may  compiete  this 
form.  This  form  is  intended  to  summarize  information  about  a  security  breach  that  may  be  reievant  to  the 
threat  evaiuation  process.  This  form  shouid  be  compieted  for  each  iocation  where  a  security  incident  was 
discovered. 


DISCOVERY  OF  SECURITY  INCIDENT 

Date/Time  security  Incident  discovered:  _ 

Name  of  person  who  discovered  security  incident: 


Mode  of  discovery: 


□ 

Alarm  (building) 

□ 

Alarm  (gate/fence) 

□  Alarm  (access  hatch) 

□ 

Video  surveillance 

□ 

Utility  staff  discovery 

□  Citizen  discovery 

□ 

Suspect  confession 

□ 

Law  enforcement  discovery 

□ 

Other 

Did  anyone  observe  the  security  incident  as  it  occurred?  □  Yes  □  No 

If  “Yes”,  complete  the  ‘Witness  Account  Report’  (Appendix  8.4) 


SITE  DESCRIPTION 

Site  Name:  _ 

Type  of  facility 


□ 

Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

□ 

Distribution  main 

Other 

□ 

Hydrant 

□ 

Service  connection 

Address: 


Additional  Site  Information: 


BACKGROUND  INFORMATION 

Have  the  following  “normal  activities”  been  investigated  as  potential  causes  of  the  security 
incident? 

□  Alarms  with  known  and  harmless  causes  □  Utility  staff  inspections 

□  Routine  water  quality  sampling  □ 

□  Contractor  activity  □ 


Construction  or  maintenance 
Other 
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Was  this  site  recently  visited  pr/or  to  the  security  incident?  □  Yes  □  No 

If  “Yes,  "provide  additional  detail  below 

Date  and  time  of  previous  visit:  _ 

Name  of  individual  who  visited  the  site:  _ 

Additional  Information:  _ 

Has  this  location  been  the  site  of  previous  security  incidents?  □  Yes  □  No 

If  “Yes,  "provide  additional  detail  below 

Date  and  time  of  most  recent  security  incident:  _ 

Description  of  incident:  _ 


What  were  the  results  of  the  threat  evaluation  for  this  incident? 

□  ‘Possible’  □  ‘Credible’  □  ‘Confirmed’ 

Have  security  incidents  occurred  at  other /ocaf/ons  recently?  □  Yes  □  No 

If  “Yes",  complete  additional  ‘Security  Incident  Reports’  (Appendix  8.3)  for  each  site 

Name  of  1®’ additional  site:  _ 

Name  of  2"'^  additional  site:  _ 

Name  of  3'^'^  additional  site:  _ 


SECURITY  INCIDENT  DETAILS 

Was  there  an  alarm(s)  associated  with  the  security  incident?  □  Yes  □  No 

If  “Yes,  "provide  additional  detail  below 

Are  there  sequential  alarms  (e.g.,  alarm  on  a  gate  and  a  hatch)?  □  Yes  □  No 

Date  and  time  of  alarm(s):  _ 

Describe  alarm(s):  _ 


Is  video  surveillance  available  from  the  site  of  the  security  incident?  □  Yes  □  No 

If  “Yes,  "provide  additional  detail  below 

Date  and  time  of  video  surveillance:  _ 

Describe  surveillance:  _ 
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Unusual  equipment  found  at  the  site  and  time 

□  Discarded  PPE  (e.g.,  gloves,  masks) 

□  Tools  (e.g.,  wrenches,  bolt  cutters) 

□  Lab  equipment  (e.g.,  beakers,  tubing) 

□  None 

Describe  equipment:  _ 


of  discovery  of  the  security  incident: 

□  Empty  containers  (e.g.,  bottles,  drums) 

□  Hardware  (e.g.,  valves,  pipe) 

□  Pumps  or  hoses 

□  Other  _ 


Unusual  vehicles  found  at  the  site  and  time  of  discovery  of  the  security  incident: 

□  Car/sedan  □  SUV  □  Pickup  truck 

□  Flatbed  truck  □  Construction  vehicle  □  None 

□  Other  _ 

Describe  vehicles  (including  make/model/year/color,  license  plate  #,  and  logos  or  markings): 


Signs  of  tampering  at  the  site  and  time  of  discovery  of  the  security  incident: 

□  Cut  locks/fences  □  Open/damaged  gates,  doors,  or  windows 

□  Open/damaged  access  hatches  □  Missing/damaged  equipment 

□  Facility  in  disarray  □  None 

□  Other  _ 

Are  there  signs  of  sequential  intrusion  (e.g.,  locks  removed  from  a  gate  and  hatch)?  □  Yes 

□  No 


Describe  signs  of  tampering: 


Signs  of  hazard  at  the  site  and  time  of  discovery  of  the  security  incident: 

□  Unexplained  or  unusual  odors  □  Unexplained  dead  animals 

□  Unexplained  dead  or  stressed  vegetation  □  Unexplained  liquids 

□  Unexplained  clouds  or  vapors  □  None 

□  Other  _ 

Describe  signs  of  hazard:  _ 


SIGNOFF 

Name  of  person  responsible  for  documenting  the  security  incident: 

Print  name  _ 

Signature  _  Date/Time: 
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2.5  Witness  Account  Report  Form 

INSTRUCTIONS 

The  purpose  of  this  form  is  to  document  the  observations  of  a  witness  to  activities  that  might  be 
considered  an  incident  warning.  The  individuai  interviewing  the  witness,  or  potentiaiiy  the  witness,  shouid 
compiete  this  form.  This  may  be  the  WUERM  or  an  individuai  designated  by  incident  command  to 
perform  the  interview.  If  iaw  enforcement  is  conducting  the  interview  (which  may  often  be  the  case),  then 
this  form  may  serve  as  a  prompt  for  “utiiity  reievant  information”  that  shouid  be  pursued  during  the 
interview.  This  form  is  intended  to  consoiidate  the  detaiis  of  the  witness  account  that  may  be  reievant  to 
the  threat  evaiuation  process.  This  form  shouid  be  compieted  for  each  witness  that  is  interviewed. 


BASIC  INFORMATION 

Date/Time  of  Interview:  _ 

Name  of  person  Interviewing  the  witness:  _ 

Witness  contact  Information 

Full  Name:  _ 

Address:  _ 

Day-time  phone:  _ 

Evening  phone:  _ 

E-mall  address:  _ 

Reason  the  witness  was  In  the  vicinity  of  the  suspicious  activity: 


WITNESS  ACCOUNT 

Date/Time  of  activity: 

Location  of  activity: 

Site  Name:  _ 


Type  of  facility 

□  Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additional  Site  Information: 
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Type  of  activity 

□  Trespassing  □  Vandalism  □  Breaking  and  entering 

□  Theft  □  Tampering  □  Surveillance 

□  Other  _ 


Additional  description  of  the  activity 


Description  of  suspects 

Were  suspects  present  at  the  site?  □  Yes  □  No 

How  many  suspects  were  present?  _ 


Describe  each  suspect’s  appearance: 


Suspect  # 

Sex 

Race 

Hair  color 

Clothing 

Voice 

1 

2 

3 

4 

5 

6 

Where  any  of  the  suspects  wearing  uniforms?  □  Yes  □  No 

If  “Yes,”  describe  the  uniform(s):  _ 


Describe  any  other  unusual  characteristics  of  the  suspects: 


Did  any  of  the  suspects  notice  the  witness?  □  Yes  □  No 

If  “Yes,”  how  did  they  respond:  _ 

Vehicles  at  the  site 

Were  vehicles  present  at  the  site?  □  Yes  □  No 

Did  the  vehicles  appear  to  belong  to  the  suspects?  □  Yes  □  No 

How  many  vehicles  were  present?  _ 
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Describe  each  vehicle: 


Vehicie  # 

Type 

Coior 

Make 

Modei 

License  piate 

1 

2 

3 

4 

5 

6 

Where  there  any  logos  or  distinguishing  markings  on  the  vehicles?  □  Yes  □  No 

If  “Yes,”  describe:  _ 


Provide  any  additional  detail  about  the  vehicles  and  how  they  were  used  (if  at  all): 


Equipment  at  the  site 

Was  any  unusual  equipment  present  at  the  site?  □  Yes  □  No 


□  Explosive  or  incendiary  devices 

□  PPE  (e.g.,  gloves,  masks) 

□  Tools  (e.g.,  wrenches,  bolt  cutters) 

□  Lab  equipment  (e.g.,  beakers,  tubing) 

□  Other 


□  Firearms 

□  Containers  (e.g.,  bottles,  drums) 

□  Hardware  (e.g.,  valves,  pipe,  hoses) 

□  Pumps  and  related  equipment 


Describe  the  equipment  and  how  it  was  being  used  by  the  suspects  (if  at  all): 


Unusuai  conditions  at  the  site 

Were  there  any  unusual  conditions  at  the  site? 

□  Explosions  or  fires  □  Fogs  or  vapors 

□  Dead/stressed  vegetation  □  Dead  animals 

□  Other  _ 

Describe  the  site  conditions:  _ 


□  Yes  □  No 

□  Unusual  odors 

□  Unusual  noises 
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Additional  observations 

Describe  any  additional  details  from  the  witness  account: 


SIGNOFF 

Name  of  interviewer: 

Print  name  _ 

Signature  _  Date/Time: 

Name  of  witness: 

Print  name  _ 

Signature  _  Date/Time: 
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2.6  Phone  Threat  Report  Form 

INSTRUCTIONS 

This  form  is  intended  to  be  used  by  utiiity  staff  that  reguiariy  answer  phone  caiis  from  the  pubiic  (e.g.,  caii 
center  operators).  The  purpose  of  this  form  is  to  heip  these  staff  capturer  as  much  information  from  a 
threatening  phone  caii  whiie  the  caiier  is  on  the  tine,  it  is  important  that  the  operator  keep  the  caiier  on 
the  tine  as  iong  as  possibie  in  order  to  coiiect  additionai  information.  Since  this  form  wiii  be  used  during 
the  caii,  it  is  important  that  operators  become  famiiiar  with  the  content  of  the  form.  The  sections  of  the 
form  are  organized  with  the  information  that  shouid  be  coiiected  during  the  caii  at  the  front  of  the  form 
(i.e.,  Basic  Caii  information  and  Detaiis  of  Threat)  and  information  that  can  be  compieted  immediateiy 
foiiowing  the  caii  at  the  end  of  the  form  (i.e.,  the  description  of  the  caiier).  The  information  coiiected  on 
this  form  wifi  be  criticai  to  the  threat  evaiuation  process. 

Remember,  tampering  with  a  drinking  water  system  is  a  crime  under  the  SDWA  Amendments! 
THREAT  NOTIFICATION 

Name  of  person  receiving  the  call:  _ 

Date  phone  call  received:  _  Time  phone  call  received:  _ 

Time  phone  call  ended:  _  Duration  of  phone  call:  _ 

Originating  number:  _  Originating  name:  _ 

if  the  number/name  is  not  dispiayed  on  the  caiier  iD,  press  *57  (or  caii  trace)  at  the  end  of  the 
caii  and  inform  iaw  enforcement  that  the  phone  company  may  have  trace  information. 


Is  the  connection  clear? 

□  Yes 

□  No 

Could  call  be  from  a  wireless  phone? 

□  Yes 

□  No 

DETAILS  OF  THREAT 

Has  the  water  already  been  contaminated?  □  Yes  □  No 

Date  and  time  of  contaminant  Introduction  known?  □  Yes  □  No 

Date  and  time  if  known:  _ 

Location  of  contaminant  Introduction  known?  □  Yes  □  No 

Site  Name:  _ 


Type  of  faciiity 

□  Source  water 

□ 

Treatment  piant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Eievated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additionai  Site  Information: 
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Name  or  type  of  contaminant  known?  □  Yes  □  No 

Type  of  contaminant 

□  Chemical  □  Biological  □  Radiological 

Specific  contaminant  name/description:  _ 


Mode  of  contaminant  introduction  known?  □  Yes  □  No 

Method  of  addition:  □  Single  dose  □  Overtime  □  Other  _ 

Amount  of  material:  _ 

Additional  Information:  _ 


Motive  for  contamination  known?  □  Yes  □  No 

□  Retaliation/revenge  □  Political  cause  □  Religious  doctrine 

□  Other  _ 

Describe  motivation:  _ 


CALLER  iNFORMATiON 
Basic  information: 

Stated  name:  _ 

Affiliation:  _ 

Phone  number:  _ 
Location/address: 

Caiier’s  Voice: 


Did  the  voice  sound  disguised  or  altered?  □  Yes 

Did  the  call  sound  like  a  recording?  □  Yes 

Did  the  voice  sound?  □  Male  /  □  Female 

Did  the  voice  sound  familiar?  □  Yes 

If  ‘Yes,’  who  did  it  sound  like?  _ 

Did  the  caller  have  an  accent?  □  Yes 

If  ‘Yes,’  what  nationality?  _ 


□  No 

□  No 

□  Young  /  □  Old 

□  No 

□  No 


How  did  the  caller  sound  or  speak? 

□  Educated 

□  Well  spoken 

□  Illiterate 

□  Irrational 

□  Obscene 

□  Incoherent 

□  Reading  a  script 

□  Other 
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What  was  the  caller’s  tone  of  voice? 


□  Calm 

□  Angry 

□  Lisping 

□ 

Stuttering/broken 

□  Excited 

□  Nervous 

□  Sincere 

□ 

Insincere 

□  Slow 

□  Rapid 

□  Normal 

□ 

Slurred 

□  Soft 

□  Loud 

□  Nasal 

□ 

Clearing  throat 

□  Laughing 

□  Crying 

□  Clear 

□ 

Deep  breathing 

□  Deep 

□  Other 

□  High 

□  Raspy 

□ 

Cracking 

Were  there  background  noises  coming  from  the  caller’s  end? 

□  Silence 

□  Voices  describe  _ 

□  Children  describe  _ 

□  Animals  describe  _ 

□  Factory  sounds  describe  _ 

□  Office  sounds  describe  _ 

□  Music  describe  _ 

□  TraffIc/street  sounds  describe  _ 

□  Airplanes  describe  _ 

□  Trains  describe  _ 

□  Ships  or  large  boats  describe  _ 


□  Other: 


SIGNOFF 

Name  of  call  recipient: 

Print  name  _ 

Signature  _  Date/Time: 

Name  of  person  completing  form  (If  different  from  call  recipient): 

Print  name  _ 

Signature  _  Date/Time: 
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2.7  Written  Threat  Report  Form 

INSTRUCTIONS 

The  purpose  of  this  form  is  to  summarize  significant  information  from  a  written  threat  received  by  a 
drinking  water  utiiity.  This  form  shouid  be  compieted  by  the  WUERM  or  an  individuai  designated  by 
incident  command  to  evaiuate  the  written  threat.  The  summary  information  provided  in  this  form  is 
intended  to  support  the  threat  evaiuation  process;  however,  the  compieted  form  is  not  a  substitute  for  the 
compiete  written  threat,  which  may  contain  additionai,  significant  detaiis. 

The  written  threat  itseif  (e.g.,  the  note,  tetter,  e-maii  message,  etc.)  may  be  considered  evidence  and  thus 
shouid  be  minimaiiy  bandied  (or  not  bandied  at  ait)  and  piaced  into  a  dean  piastic  bag  to  preserve  any 
forensic  evidence. 

Remember,  tampering  with  a  drinking  water  system  is  a  crime  under  the  SDWA  Amendments! 


SAFETY 

A  suspicious  tetter  or  package  couid  pose  a  threat  in  and  of  itseif,  so  caution  shouid  be  exercised  if  such 
packages  are  received.  The  US  Postat  Service  has  issued  guidance  when  deaiing  with  suspicious 
packages  fhttp://www. usDS.eom/news/200 l/press/pr0 1  1 022asa. htm). 


THREAT  NOTIFICATION 

Name  of  person  receiving  the  written  threat:  _ 

Person(s)  to  whom  threat  was  addressed:  _ 

Date  threat  received:  _  Time  threat  received:  _ 

How  was  the  written  threat  received? 

□  US  Postal  service  □  Delivery  service  □  Courier 

□  Fax  □  E-mail  □  Hand  delivered 

□  Other  _ 

If  mailed,  is  the  return  address  listed?  □  Yes  □  No 


If  mailed,  what  is  the  date  and  location  of  the  postmark?  _ 

If  delivered,  what  was  the  service  used  (list  any  tracking  numbers)? 

If  Faxed,  what  is  the  number  of  the  sending  fax?  _ 

If  E-mailed,  what  is  the  e-mail  address  of  sender?  _ 

If  hand-delivered,  who  delivered  the  message?  _ 
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DETAILS  OF  THREAT 

Has  the  water  already  been  contaminated?  □  Yes  □  No 

Date  and  time  of  contaminant  introduction  known?  □  Yes  □  No 

Date  and  time  if  known:  _ 

Location  of  contaminant  introduction  known?  □  Yes  □  No 

Site  Name:  _ 


Type  of  facility 

□  Source  water 

□ 

Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 

□ 

Elevated  storage  tank 

□ 

Finished  water  reservoir 

□ 

Distribution  main 

□ 

Hydrant 

□ 

Service  connection 

□ 

Other 

Address: 


Additionai  Site  Information: 


Name  or  type  of  contaminant  known?  □  Yes  □  No 

Type  of  contaminant 

□  Chemicai  □  Bioiogical  □  Radiological 

Specific  contaminant  name/description:  _ 


Mode  of  contaminant  introduction  known?  □  Yes  □  No 

Method  of  addition:  □  Single  dose  □  Overtime  □  Other  _ 

Amount  of  material:  _ 

Additional  Information:  _ 


Motive  for  contamination  known?  □  Yes  □  No 

□  Retaliation/revenge  □  Political  cause  □  Religious  doctrine 

□  Other  _ 

Describe  motivation:  _ 


NOTE  CHARACTERISITCS 
Perpetrator  Information: 

Stated  name:  _ 

Affiliation:  _ 

Phone  number:  _ 

Location/address: 
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Condition  of  paper/enveiop: 


□ 

Marked  personal 

□  Marked  confidential 

□ 

Properly  addressed 

□ 

Neatly  typed  or  written 

□  Clean 

□ 

Corrected  or  marked-up 

□ 

□ 

Crumpled  or  wadded  up 
Other: 

□  Soiled/stained 

□ 

Torn/tattered 

How  was  the  note  prepared? 

□  Handwritten  in  print 

□  Machine  typed 

□  Other: 

□  Handwritten  in  script  □  Computer  typed 

□  Spliced  (e.g.,  from  other  typed  material) 

If  handwritten,  does  writing  look  familiar?  □  Yes 

□  No 

Language: 

□  Clear  English 

□  Another  lanauaae: 

□  Poor  English 

□  Mixed  lanauaaes: 

Writing  Styie 

□  Educated 

□  Uneducated 

□  Use  of  slang 

□  Other: 

□  Proper  grammar 

□  Poor  grammar/spelling 

□  Obscene 

□  Logical 

□  Incoherent 

Writing  Tone 

□  Clear 

□  Condescending 

□  Agitated 

□  Other: 

□  Direct 

□  Accusatory 

□  Nervous 

□  Sincere 

□  Angry 

□  Irrational 

SiGNOFF 

Name  of  individual  who  received  the  threat: 

Print  name  _ 

Signature  _  Date/Time: 

Name  of  person  completing  form  (if  different  from  written  threat  recipient): 

Print  name  _ 

Signature  _  Date/Time: 
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2.8  Water  Quality/Consumer  Complaint  Report  Form 

INSTRUCTIONS 

This  form  is  provided  to  guide  the  individuai  responsibie  for  evaiuating  unusuai  water  quaiity  data  or 
consumer  compiaints.  it  is  designed  to  prompt  the  anaiyst  to  consider  various  factors  or  information 
when  evaiuating  the  unusuai  data.  The  actuai  data  used  in  this  anaiysis  shouid  be  compiied  separateiy 
and  appended  to  this  form.  The  form  can  be  used  to  support  the  threat  evaiuation  due  to  a  threat  warning 
from  unusuai  water  quaiity  or  consumer  compiaints,  or  another  type  of  threat  warning  in  which  water 
quaiity  data  or  consumer  compiaints  are  used  to  support  the  evaiuation. 

Note  that  in  this  form,  water  quaiity  refers  to  both  specific  water  quaiity  parameters  and  the  generai 
aesthetic  characteristics  of  the  water  that  might  resuit  in  consumer  compiaints. 

Threat  warning  is  based  on:  □  Water  quality  □  Consumer  complaints  □  Other 

What  is  the  water  quality  parameter  or  complaint  under  consideration? 

Are  unusual  consumer  complaints  corroborated  by  unusual  water  quality  data? 

Is  the  unusual  water  quality  indicative  of  a  particular  contaminant  of  concern?  For  example,  is  the 
color,  order,  or  taste  associated  with  a  particular  contaminant? 

Are  consumers  in  the  affected  area  experiencing  any  unusual  health  symptoms? 

What  is  ‘typical’  for  consumer  complaints  for  the  current  season  and  water  quality? 

Number  of  complaints. 

Nature  of  complaints. 

Clustering  of  complaints 

What  is  considered  to  be  ‘normal’  water  quality  (i.e.,  what  is  the  baseline  water  quality  data  or 
level  of  consumer  complaints)? 

What  is  reliability  of  the  method  or  instrumentation  used  for  the  water  quality  analysis? 

Are  standards  and  reagents  OK? 

Is  the  method/instrument  functioning  properly? 

Based  on  recent  data,  does  the  unusual  water  quality  appear  to  be  part  of  a  gradual  trend  (i.e., 
occurring  over  several  days  or  longer)? 

Are  the  unusual  water  quality  observations  sporadic  over  a  wide  area,  or  are  they  clustered  in  a 
particular  area? 

What  is  the  extent  of  the  area?  A  pressure  zone.  A  neighborhood.  A  city  block.  A  street.  A 
building. 
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If  the  unusual  condition  Isolated  to  a  specific  area: 

Is  this  area  being  supplied  by  a  particular  plant  or  source  water? 

Have  there  been  any  operational  changes  at  the  plant  or  in  the  affected  area  of  the  system? 
Has  there  been  any  flushing  or  distribution  system  maintenance  in  the  affected  area? 

Has  there  been  any  repair  or  construction  in  the  area  that  could  impact  water  quality? 


SIGNOFF 

Name  of  person  completing  form: 

Print  name  _ 

Signature  _  Date/Time: 
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2.9  Public  Health  Information  Report  Form 

INSTRUCTIONS 

The  purpose  of  this  form  is  to  summarize  significant  information  about  a  pubiic  heaith  episode  that  couid 
be  iinked  to  contaminated  water.  This  form  shouid  be  compieted  by  the  WUERM  or  an  individuai 
designated  by  incident  command.  The  information  complied  in  this  form  is  intended  to  support  the  threat 
evaiuation  process. 

In  the  case  of  a  threat  warning  due  to  a  report  from  public  health,  it  is  likely  that  the  public  health  agency 
will  assume  incident  command  during  the  investigation.  The  drinking  water  utility  will  likely  play  a  support 
role  during  the  investigation,  specifically  to  help  determine  whether  or  not  water  might  be  the  cause. 

PUBLIC  HEALTH  NOTIFICATION 

Date  and  Time  of  notification:  _  _ 


Name  of  person  who  received  the  notification:  _ 

Contact  Information  for  Individual  providing  the  notification 

Full  Name:  _ 

Title:  _ 

Organization:  _ 

Address:  _ 

Day-time  phone:  _ 

Evening  phone:  _ 

Fax  Number:  _ 

E-mall  address:  _ 

Why  is  this  person  contacting  the  drinking  water  utility?  _ 


Has  the  state  or  local  public  health  agency  been  notified?  □  Yes  □  No 

If  “No,”  the  appropriate  public  health  official  should  be  Immediately  notified. 


DESCRIPTION  OF  PUBLIC  HEALTH  EPISODE 
Nature  of  public  health  episode: 

□  Unusual  disease  (mild)  □  Unusual  disease  (severe)  □  Death 

□  Other:  _ 

Symptoms: 

□  Diarrhea  □  VomItIng/nausea  □  Flu-llke  symptoms 

□  Fever  □  Headache  □  Breathing  difficulty 

□  Other:  _ 

Describe  symptoms:  _ 


Causative  Agent:  □  Known  □  Suspected  □  Unknown 

If  known  or  suspected,  provide  additional  detail  below 

□  Chemical  □  Biological  □  Radiological 

Describe  _ 


Estimate  of  time  between  exposure  and  onset  of  symptoms: 
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Exposed  Individuals: 

Location  where  exposure  is  thought  to  have  occurred 

□  Residence  □  Work  □  School 

□  Restaurant  □  Shopping  mall  □  Social  gathering 

□  Other:  _ 

Additional  notes  on  location  of  exposure:  _ 


Collect  addresses  for  specific  locations  where  exposure  is  thought  to  have  occurred. 

Is  the  pattern  of  exposure  clustered  in  a  specific  area?  □  Yes  □  No 

Extent  of  area 

□  Single  building  □  Complex  (several  buildings)  □  City  block 

□  Neighborhood  □  Cluster  of  neighborhoods  □  Large  section  of  city 

□  Other:  _ 

Additional  notes  on  extent  of  area:  _ 


Do  the  exposed  individuals  represent  a  disproportionate  number  of: 

□  Immune  compromised  □  Elderly  □  Children 

□  Infants  □  Pregnant  women  □  Women 

□  Other:  _ 

□  None,  no  specific  groups  dominate  the  makeup  of  exposed  individuals 

EVALUATION  OF  LINK  TO  WATER 

Are  the  symptoms  consistent  with  typical  waterborne  diseases,  such  as  gastrointestinal 


disease,  vomiting,  or  diarrhea? 

□ 

Yes 

□ 

No 

Does  the  area  of  exposure  coincide  with  a  specific  area  of  the  system. 

such  as  a  pressure 

zone  or  area  feed  by  a  specific  plant? 

□ 

Yes 

□ 

No 

Were  there  any  consumer  complaints  within  the  affected  area? 

□ 

Yes 

□ 

No 

Were  there  any  unusual  water  quality  data  within  the  affected  area? 

□ 

Yes 

□ 

No 

Were  there  any  process  upsets  or  operational  changes? 

□ 

Yes 

□ 

No 

Was  there  any  construction/maintenance  within  the  affected  area? 

□ 

Yes 

□ 

No 

Were  there  any  security  incidents  within  the  affected  area? 

□ 

Yes 

□ 

No 

SIGNOFF 

Name  of  person  completing  form: 

Print  name  _ 

Signature  _  Date/Time: 
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3  Site  Characterization  and  Sampling 

3. 1  Site  Characterization  Process 


Initial  evaluation 


Identify  investigation  site 


Characterize  site  hazards 


Develop  sampling  approach 


Form  site  characterization  team 


Conduct  field  safety  screening 


Observe  site  conditions  and 
determine  signs  of  hazard 


Repeat  field  safety  screening 


Investigate  site  and  evaluate 
hazards 


Conduct  field  water  testing 
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3.2  Emergency  Water  Sample  Collection  Kit 


Item  Quantity 

Notes 

Field  Resources  and  Documentation 

Field  guide 

2 

Resource  for  field  personnel 

Health  and  safety  plan 

2 

If  required  for  the  site 

Sample  labels 

48 

Waterproof  (filled  out  in  advance,  if  possible) 

Sample  documentation  forms 

24 

For  recording  sample  information 

Custody  tape  (or  seals) 

2  rolls 

Used  on  sample  or  shipping  containers 

Chain  of  custody  forms 

24 

For  documenting  sample  custody 

Lab  marker 

2 

Waterproof,  1  red,  1  black 

General  Sampling  Supplies 

Sample  containers 

Table  3-2 

For  collecting  samples 

Device  for  grab  sampling 

1 

For  sampling  large  water  bodies 

10  liter  HDPE  container 

4 

For  collection  of  large  volume  water  samples 

Lab  grade  tape 

3  rolls 

For  temporary  labeling  in  the  field 

Miscellaneous  glassware 

N/A 

Beakers,  graduated  cylinders,  spatula,  etc. 

Collapsible  cooler 

1 

For  sample  storage 

Rigid  shipping  container 

1 

For  shipping  by  overnight  service  if  needed. 

1  qt.  zippered  freezer  bags 

1  packlOO 

For  double  bagging  ice  and  sample  containers 

Thermometer 

2 

For  checking  water  temperature 

Paper  towels 

2  rolls 

Wiping  wet  containers  and  containing  spills 

Pathogen  Sampling  Supplies 

Tubing  and  clamp 

1 

For  sample  tap  flushing,  etc. 

Stopwatch  &  graduated  cylinder 

1 

For  measuring  flow  rate 

Ultrafiltration  apparatus 

1 

For  concentrating  pathogen  samples 

Reagents  (may  need  to  be  kept  separate  from  the  rest  of  the  kit) 

Laboratory  grade  water 

5  liters 

For  sample  dilution  in  the  field 

Sodium  thiosulfate  crystals 

100  grams 

For  water  sample  dechlorination 

Ascorbic  acid 

100  grams 

For  water  sample  dechlorination 

Sodium  sulfite  crystals 

100  grams 

For  water  sample  dechlorination 

Potassium  dihydrogen  citrate 

100  grams 

For  carbamate  preservation 

6  Molar  ACS  grade  hydrochloric 
acid  (HCl) 

25  mL 

In  dropper  bottle  for  preservation  of  samples  for 
organic  analyses 

6  Molar  trace  metal-grade  nitric 
acid  (HNO3) 

25  mL 

In  dropper  bottle  for  preservation  of  samples  for 
trace  metals  analysis 

10  Normal  Sodium  hydroxide 
(NaOH) 

25  mL 

In  dropper  bottle  for  preservation  of  samples  for 
cyanide  analyses 

pH  paper  in  ranges  from  0-4  and 
10-  14 

50  strips 

For  checking  the  pH  of  samples  preserved  with 
acid  or  base  (sensitive  to  0.5  pH  units) 

Safety  Supplies 

Splash  resistant  goggles 

2 

One  per  individual  (minimum) 

Disposable  gloves 

6  pairs 

Nitrile  or  polyethylene,  powder-free 

Disposable  shoe  covers 

2  pairs 

One  pair  per  individual  (minimum) 

Disposable  laboratory  coats 

2 

One  per  individual  (minimum) 

Clear,  heavy  duty  plastic  trash  bags 

4 

For  disposal  of  lab  coat,  gloves,  etc. 

Rinse  water 

20  liters 

For  general  use  and  first  aid 

Antiseptic  wipes 

1  container 

For  cleaning  hands,  sample  containers,  etc. 

Bleach  solution  (at  least  5%) 

1  gallon 

For  decontamination  if  necessary 

Squirt  bottle 

2 

For  use  with  rinse  water  or  lab  grade  water 

First  aid  kit 

1 

For  general  first  aid 

Flashlight/headlamp 

3 

For  working  at  night  or  in  dark  locations 
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3.4  Sample  Collection  Guidelines 

3.4.1  Safety  Guidelines 

1.  Do  not  enter  the  site  to  perform  sampling  until  cleared.  Hazardous  materials  response 
units  may  perform  safety  screening  before  allowing  other  responders  to  enter  the  site. 
Note  that  field  safety  screening  does  not  generally  include  testing  for  pathogens. 

2.  Do  not  eat,  drink,  or  smoke  at  the  site. 

3.  Do  not  taste  or  smell  the  water  samples. 

4.  Do  use  general  personal  protective  equipment  (PPE)  such  as  splash-proof  goggles, 
disposable  gloves,  proper  footwear  (i.e.,  no  open  toe  or  open  heel  shoes),  a  chemical 
resistant,  disposable  lab  coat,  and  long  pants.  {Note  that  this  level  of  PPE  is  only 
intended  to  minimize  incidental  contact  with  the  water  or  chemical  reagents  used  during 
sample  collection  or  field  testing.) 

5.  Avoid  all  skin  contact  with  the  water,  and  if  incidental  contact  does  occur,  immediately 
flush  the  affected  area  with  clean  water  brought  to  the  site  for  that  purpose. 

6.  Fill  sampling  containers  slowly  to  avoid  volatilization  or  aerosolization  of  contaminants. 

7.  Minimize  the  time  that  personnel  are  on  the  site  and  collecting  samples. 

3.4.2  Sampling  Procedures 

1 .  Pre-label  sample  containers  with  a  waterproof  marker.  Information  should  include: 
analyte  class  (pathogen,  chemical,  or  radionuclide),  specific  analyte  (if  sample  is  being 
collected  for  a  specific  target),  sample  identification  number,  utility  name,  location  of 
sample  collection,  sample  collection  date  and  time,  and  sampler’s  initials. 

2.  Check  for  the  presence  of  any  in-line  filters  (e.g.,  home  treatment  devices)  that  might 
interfere  with  sampling.  Remove  such  devices  if  present. 

3.  If  the  sample  tap  is  the  suspected  point  of  contaminant  introduction,  collect  swab  samples 
from  the  tap  before  flushing  the  tap  and  collecting  water  samples. 

4.  Flush  sample  taps  for  a  time  sufficient  to  displace  the  water  in  connecting  lines  in  order 
to  obtain  a  sample  that  is  representative  of  the  water  of  interest.  Keep  the  flow  rate  from 
the  sample  tap  sufficiently  low  in  order  to  avoid  splashing  and  aerosolizing  water 
droplets.  Divert  water  to  a  drain  if  possible. 

5.  Carefully  collect  samples  in  the  specified  containers  (see  Section  3.3).  If  a  reagent  needs 
to  be  added  to  the  sample,  allow  enough  headspace  in  the  container  to  add  the  proper 
amount  of  preservative.  Cap  then  gently  mix  the  contents  to  ensure  that  the  reagent  is 
properly  mixed  with  the  sample.  Test  the  sample  with  a  strip  of  pH  paper  to  ensure 
preservation  to  the  proper  pH.  Do  not  insert  the  pH  paper  into  the  sample  container. 

Pour  a  small  portion  of  the  mixed  sample  into  the  container  cap  then  pour  from  the  cap 
onto  the  pH  paper  to  verify 

6.  For  chlorinated  samples,  VOCs  should  be  collected  into  a  secondary  8-oz.  glass  container 
(prepared  with  ascorbic  acid  -  see  footnote  1,  Table  3.3).  Gently  mix  the  sample  and 
transfer  to  3,  40-ml  VGA  containers  (triplicate).  Fill  the  40-ml  container  above  the  top  to 
form  a  meniscus.  Close  the  container  with  the  Teflon  side  of  the  septa  facing  the  water 
sample,  gently  invert  the  sample  container  several  times,  and  verify  that  there  are  no  air 
bubbles  in  the  container.  Once  each  container  is  tagged,  the  three  40-ml  containers 
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should  be  inserted  into  a  plastic  whirlpack  bag  (provided)  and  sealed  prior  to  sample 
storage. 

7.  Wipe  the  outside  of  the  sealed  containers  with  paper  towel. 

8.  Attach  custody  seal  to  the  sample  container. 

9.  Place  the  sealed  container  into  a  rigid  cooler  and  pack  with  frozen  ice  packs  (preferred) 
or  sealable  freezer  bags  filled  with  ice. 

10.  Tag  each  sample  and  record  all  necessary  information  on  “Sample  Documentation”  and 
“Chain  of  Custody”  forms. 

11.  After  all  samples  have  been  collected,  preservative  blanks  and  temperature  blanks  should 
be  prepared  and  tagged.  A  preservative  blank  should  be  prepared  for  each  preservative 
used  during  the  sampling  event.  The  preservative  blank  can  be  prepared  by  adding  the 
appropriate  amount  of  preservative  to  the  preservative  blank  containers,  and  tagging  the 
sample  for  the  appropriate  analysis  (i.e.,  HN03  preservative  blank  should  be  analyzed  for 
metals).  Additionally,  a  temperature  blank  container  should  be  placed  in  each  cooler 
containing  samples. 

3.4.3  Sample  Holding 

1.  When  samples  are  not  in  the  possession  of  designated  personnel,  they  should  be  secured 
(e.g.,  locked  in  a  secure  area)  and  only  accessible  by  designated  personnel.  In  the  field, 
samples  may  need  to  be  locked  in  a  vehicle. 

2.  Samples  should  be  chilled,  but  protected  from  freezing. 

3.  Samples  should  be  held  at  the  drinking  water  utility  lab  until  shipped  to  a  lab  for  analysis 
or  until  it  is  determined  that  they  are  not  needed. 

4.  Samples  that  are  held  longer  than  the  approved  holding  times  for  contaminant  analysis 
may  no  longer  be  useful. 

3.4.4  Sample  Transport 

1 .  Sample  integrity  and  chain  of  custody  must  be  maintained.  All  factors  that  might 
compromise  sample  integrity  (e.g.,  storage  containers,  excessive  transit  time, 
temperature,  pressure,  physical  disturbance,  etc.)  should  be  considered  and  appropriate 
measures  taken  to  avoid  compromising  samples. 

2.  Sample  packaging  must  be  in  compliance  with  shipping  regulations. 

3.  Samples  may  be  screened  by  law  enforcement  and/or  ICs  prior  to  sample  transport  to  the 
laboratory. 

4.  Samples  will  be  transported  to  the  appropriate  laboratory  in  coordination  with  law 
enforcement  using  appropriate  air  and  ground  assets. 
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3.5  Site  Characterization  Pian  Tempiate 

INSTRUCTIONS 

This  form  is  intended  to  support  the  development  of  a  customized  site  characterization  plan 
developed  in  response  to  a  specific  water  contamination  threat.  The  incident  commander  and 
site  characterization  team  leader  should  develop  this  plan  jointly  if  possible.  The  completed 
form  will  be  used  to  guide  site  characterization  activities  in  the  field;  however,  it  may  be 
necessary  to  revise  the  initial  plan  based  on  initial  observations  at  the  site.  A  form  should  be 
completed  for  each  investigation  site  that  will  be  characterized. 

THREAT  WARNING  INFORMATION 

Consult  Module  2,  Appendix  8.2  “Threat  Evaluation  Worksheet”  for  details  about  the 
threat. 

INVESTIGATION  SITE 

Site  Name:  _ 

Type  of  facility: 


□ 

Source  water 

□  Treatment  plant 

□ 

Pump  station 

□ 

Ground  storage  tank 
reservoir 

□  Elevated  storage  tank 

□ 

Finished  water 

□ 

□ 

Distribution  main 

Other 

□  Hydrant 

□ 

Service  connection 

Address: 


Additional  Site  Information: 


INITIAL  HAZARD  ASSESSMENT 

Are  there  any  indicators  of  an  explosive  hazard?  □  Yes  □  No 

If  “Yes,  ”  notify  law  enforcement  and  do  not  send  a  team  to  the  site. 

Initial  hazard  categorization 

□  Low  hazard  □  Chemical  hazard 

□  Radiological  hazard  □  Biological  hazard 

If  the  initial  hazard  assessment  indicates  a  chemical,  radiological,  or  biological  hazard 
(as  described  in  Module  3,  Section  4.1.3),  then  only  teams  trained  to  deal  with  such 
hazards  should  be  sent  to  the  site. 
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SITE  CHARACTERIZATION  TEAM 

Name  &  Affiliation  of  Site  Characterization  Team  Leader: 


Drinking  water  utility  staff: 


□  Water  quality  specialist 

□  Security  specialist 

□  Operations  specialist 

□  Other 

Name: 

Name: 

Name: 

Name: 

Representatives  from  other  agencies: 

□  Local  law  enforcement 

□  Fire  department 

□ 

HazMat 

□  US  EPA 

□  FBI 

□ 

Other 

COMMUNICATION  PROCEDURES 

Mode  of  communication: 

□  Phone 

□  2-way  radio 

□ 

Digital 

□  Facsimile 

□  Other 

Reporting  events: 

□  Upon  arrival  at  site 

□  During  approach 

□ 

Site  entry 

□  After  site  evaluation 

□  After  field  testing 

□ 

Site  exit 

□  Other  _ 

FIELD  SCREENING  CHECKLIST 


U 

Parameter^ 

Screen^ 

Meter/Kit  ID^ 

Check  Date"^ 

Reference  Value^ 

Radiation 

Both 

Chlorine  residual 

Water 

pH  /  conductivity 

Water 

Cyanide 

Water 

Volatile 

chemicals 

Safety 

Chemical 

weapons 

Both 

Biotoxins 

Water 

Pathogens 

Water 

1.  List  the  parameters  that  will  be  evaluated  as  part  of  field  screening  (examples  are  listed). 

2.  Screening  may  be  conducted  for  safety,  rapid  water  testing,  or  both. 

3.  Report  the  unique  identifier  for  the  meter  or  kit  used  during  screening. 

4.  Report  date  of  last  calibration,  last  equipment  check,  or  expiration  date  as  appropriate. 

5.  List  any  reference  value  that  would  trigger  a  particular  action,  such  as  exiting  the  site. 
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SAMPLING  CHECKLIST 


u 

Analyte^ 

No. 

Samples 

Sample  Preservation^ 

Standard  VOCs 

Semi-volatiles 

Quartenary  nitrogen 
compounds 

Cyanide 

Carbamate  pesticides 

Metals/elements 

Organometallic  compounds 

Cyanide 

Radionuclides 

Non-target  VOCs 

Non-target  organic 
compounds 

Non-target  inorganic 
compounds 

Immunoassays 

Pathogens  -  culture 

Pathogens  -  PCR 

Water  quality  -  bacteria 

Water  quality  -  chemistry 

1 .  List  the  parameters  that  will  be  sampled  during  site  characterization  (examples  are 
listed). 

2.  List  preservatives  and  dechlorinating  agents  and  indicate  if  they  are  to  be  added  in  the 


field. 


EQUIPMENT  CHECKLIST 

□  Completed  Site  Characterization  Plan 

□  Emergency  Water  Sampling  Kit  (Table  3-1) 

□  Reagents  (if  stored  separately) 

□  Laboratory  grade  water  (5  gal) 

□  Special  equipment  for  the  specific  site 

□  Other  _ 


□  Additional  documentation 

□  Field  Testing  Kit  (Table  3-3) 

□  Bags  of  ice  or  freezer  packs 

□  Rinse  water  (20  liters) 

□  Disposable  camera 
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SAMPLE  HANDLING  INSTRUCTIONS 
Sample  delivery: 

□  Return  samples  to  water  utility 

□  Ship  samples  to  specified  location 

□  Deliver  samples  to  specified  recipient  (e.g.,  laboratory,  law  enforcement,  shipping  co., 
etc.) 

Name  of  recipient:  _ 

Phone  No.:  _  Fax  No.:  _ 

Delivery  address:  _ 


Sample  storage  and  security: 

Describe  any  special  precautions  or  instructions  related  to  sample  storage  and  security: 


SIGNOFF 

Incident  Commander  (or  designee  responsible  for  developing  Site  Characterization  Plan): 
Print  name  _ 

Signature  _  Date/Time:  _ 

Site  Characterization  Team  Leader: 

Print  name  _ 

Signature  _  Date/Time:  _ 
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3.6  Site  Characterization  Report  Form 

INSTRUCTIONS 

Members  of  the  site  characterization  team  can  use  this  form  to  record  their  observations  at  the 
investigation  site.  It  also  serves  as  a  checklist  for  notifying  incident  command  at  key  points 
during  the  characterization.  Additional  checklists  are  included  in  this  form  for  sample  collection 
and  exiting  the  site.  The  completed  form  can  also  be  used  as  a  component  of  the  site 
characterization  report.  A  form  should  be  completed  for  each  investigation  site  that  is 
characterized 

GENERAL  INFORMATION 

Date:  _  Time  arrived  investigation  at  site:  _ 

Name  of  Site  Characterization  Team  Leader:  _ 

Phone  No.:  _  Fax  No.:  _ 


LOCATION  OF  INVESTIGATION  SITE 
Site  Name:  _ 

Type  of  facility: 


□ 

Source  water 

□  Treatment  plant 

□ 

Pump  station 

□ 

Finished  water  reservoir 

□  Elevated  storage  tank 

□ 

Ground  storage  tank 

□ 

□ 

Distribution  main 

Other 

□  Hydrant 

□ 

Service  connection 

Address: 


Weather  Conditions  at  Site: 


Additional  Site  Information: 
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APPROACH  TO  SITE 

Time  of  Approach  to  Site:  _ 

Initial  Field  Safety  Screening  (as  listed  in  the  “Site  Characterization  Plan”): 

□  None  □  Radiation  □  Volatile  chemicals 

□  HAZCAT  □  Chemical  weapons  □  Biological  agents 

□  Other 


Report  results  of  field  safety  screening  in  Section  3.7  “Field  Testing  Results  Form.” 
If  any  field  safety  screening  result  is  above  the  corresponding  reference  value, 
immediately  notify  incident  command  and  do  not  proceed  further  into  the  site. 

Initial  Observation  and  Assessment  of  Immediate  Hazards 

□  Unauthorized  individuals  present  at  the  site 

□  Fire  or  other  obvious  hazard 

□  Signs  of  a  potential  explosive  hazard  (e.g.,  devices  with  exposed  wires) 

□  Signs  of  a  potential  chemical  hazard  (e.g.,  dead  animals,  unusual  fogs,  unusual  odors) 

□  Unusual  and  unexplained  equipment  at  the  site 

□  Other  signs  of  immediate  hazard  _ 

If  there  are  any  indicators  of  immediate  hazard,  immediately  notify  incident  command 
and  do  not  proceed  further  into  the  site. 

Report  initial  observations  and  results  to  incident  commander. 

Approval  granted  to  proceed  further  into  the  site?  □  Yes  □  No 

SITE  INVESTIGATION 

Time  of  Entry  to  Site:  _ 

Repeat  Field  Safety  Screening 

□  None  □  Radiation 

□  HAZCAT  □  Chemical  weapons 

□  Other  _ 


Report  results  of  field  safety  screening  in  Section  3.7  “Field  Testing  Results  Form.” 
If  any  field  safety  screening  result  is  above  the  corresponding  reference  value, 
immediately  notify  incident  command  and  do  not  proceed  further  into  the  site. 

Signs  of  Hazard: 

□  None  □  Unexplained  dead  animals 

□  Unexplained  dead  or  stressed  vegetation  □  Unexplained  clouds  or  vapors 

□  Unexplained  liquids  □  Other  _ 

Describe  signs  of  hazard:  _ 


□  Volatile  chemicals 

□  Biological  agents 
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Unexplained  or  Unusual  Odors: 


□ 

None 

□  Pungent 

□ 

Irritating 

□ 

Sulfur 

□  Skunky 

□ 

Bitter  almond 

□ 

Sweet/Fruity 

□  New  mown  hay 

□ 

Other 

Describe  unusual  odor: 


Unusual  Vehicles  Found  at  the  Site: 

□  Car/sedan  □  SUV  □  Pickup  truck 

□  Flatbed  truck  □  Construction  vehicle  □  None 

□  Other  _ 

Describe  vehicles  (including  make/model/year/color,  license  plate  #,  and  logos  or 
markings):  _ 


Signs  of  Tampering: 

□  None  □  Cut  locks/fences 

□  Open/damaged  gates,  doors,  or  windows  □  Open/damaged  access  hatches 

□  Missing/damaged  equipment  □  Facility  in  disarray 

□  Other  _ 

Signs  of  sequential  intrusion  (e.g.,  locks  removed  from  a  gate  and  hatch)? 

□  Yes  □  No 

Describe  signs  of  tampering:  _ 


Unusual  Equipment: 

□  None 

□  Tools  (e.g.,  wrenches,  bolt  cutters) 

□  Lab  equipment  (e.g.,  beakers,  tubing) 

□  Other 


□  Discarded  PPE  (e.g.,  gloves,  masks) 

□  Hardware  (e.g.,  valves,  pipe) 

□  Pumping  equipment 


Describe  equipment: 
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Unusual  Containers: 
Type  of  container: 


□  None 

□  Drum/Barrel 

□  Bottle/Jar 

□  Plastic  bag 

□  Box/Bin 

□  Pressurized  cylinder 

□  Test  Tube 

□  Bulk  container 

□  Other 

Condition  of  container: 

□  Opened 

□  New 

□  Damaged/leaking 

□  Unopened 

□  Old 

□  Intact/dry 

Size  of  container:  _ 

Describe  labeling  on  container: 


Describe  visible  contents  of  container: 


Rapid  Field  Testing  of  the  Water 


□ 

None 

□  Residual  disinfectant 

□ 

pH  /  conductivity 

□ 

Cyanide 

□  Radiation 

□ 

VOCs  and  SVOCs 

□ 

□ 

Pesticides 

Other 

□  Biotoxins 

□ 

General  toxicity 

Report  results  of  rapid  field  testing  of  the  water  in  Section  3.7  “Field  Testing  Results 
Form.” 

If  any  field  test  result  is  above  the  corresponding  reference  value,  immediately  notify 
incident  command  and  wait  for  instruction  regarding  how  to  proceed. 

Report  findings  of  site  investigation  to  incident  commander. 

Approval  granted  to  proceed  with  sample  collection?  □  Yes  □  No 

SAMPLING 

Time  Sampling  was  Initiated  /  Completed:  _ / _ 


Implement  Sampling  Procedures  Appropriate  for  the  Hazard  Conditions  at  the  Site: 

□  Low  hazard  □  Chemical  hazard 

□  Radiological  hazard  □  Biological  hazard 

If  the  site  is  characterized  as  a  chemical,  radiological,  or  biological  hazard,  then  special 
sampling  and  safety  procedures  should  be  followed. 
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Safety  Checklist: 

□  Do  not  eat,  drink,  or  smoke  at  the  site. 

□  Do  not  taste  or  smell  the  water  samples. 

□  Do  use  the  general  PPE  included  in  the  emergency  water  sampling  kit. 

□  Avoid  all  contact  with  the  water,  and  flush  immediately  with  clean  water  in  the  case 
of  contact. 

□  Slowly  fill  sample  bottles  to  avoid  volatilization  and  aerosolization. 

□  Minimize  the  time  that  personnel  are  on  site  and  collecting  samples. 

General  Sampling  Guidelines: 

□  Properly  label  each  sample  bottle. 

□  Carefully  flush  sample  taps  prior  to  sample  collection,  if  applicable. 

□  Collect  samples  according  to  method  requirements  (e.g.,  w/o  headspace  for  VOCs). 

□  Add  preservatives  or  dechlorinating  agents  as  specified. 

□  Carefully  close  sample  containers  and  verify  that  they  don’t  leak. 

□  Wipe  the  outside  of  sample  containers  with  a  mild  bleach  solution  if  needed. 

□  Place  sample  containers  into  a  sealable  plastic  bag. 

□  Place  samples  into  an  appropriate,  rigid  shipping  container. 

□  Pack  container  with  frozen  ice  packs. 

□  Complete  “Sample  Documentation  Form”  (Section  3.8). 

□  Complete  “Chain  of  Custody  Form”  (Section  3.9). 

□  Secure  shipping  container  with  custody  tape. 

□  Comply  with  any  other  sample  security  provisions  required  by  participating  agencies. 

EXITING  THE  SITE 

Time  of  Site  Exit:  _ 

Site  Exit  Checklist 

□  Verify  that  hatches,  locks,  etc.  are  properly  secured. 

□  Remove  all  samples,  equipment,  and  materials  from  the  site. 

□  Verify  that  all  samples  are  in  the  cooler  and  properly  seal  the  cooler. 

□  Remove  all  PPE  at  site  perimeter. 

□  Place  disposable  PPE  and  other  trash  into  a  heavy-duty  plastic  trash  bag. 

□  Verify  that  the  perimeter  has  been  properly  secured  before  leaving  the  site. 

□  Ensure  that  all  documentation  has  been  completed  before  leaving  the  site  perimeter. 

□  Comply  with  any  site  control  measures  required  by  participating  agencies. 

□  Contact  incident  commander  and  inform  them  that  the  team  is  leaving  the  site. 


SIGNOFF 

Site  Characterization  Team  Eeader: 

Print  name  _ 

Signature  _  Date/Time: 
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2:  Report  the  unique  identifier  for  the  meter  or  kit  used  during  screening. 

3:  Report  the  specific  location  where  the  field  testing  was  conducted. 

4:  Report  the  specific  time  at  which  the  test  was  performed. 

5;  Results  of  field  testing  should  include  replicate  analysis  where  appropriate. 

6.  Results  should  be  compared  with  a  reference  value,  if  available,  to  determine  whether  or  not  the  levels  detected  pose  a  hazard. 


RESPONSE  GUIDELINES 


1:  Report  preservatives,  dechlorinating  agents,  acid/base  for  pH  adjustment,  and  any  other  sample  additives. 


3.9  Chain  of  Custody  Form 


Site  Name: _ 

Sampler  Phone  No.; 


Sample  ID 

Collection  Date 

No.  Bottles 

Analysis 

Relinquished  by: 

Received  by: 

Date/time: 

Relinquished  by: 

Received  by: 

Date/time: 

Relinquished  by: 

Received  by: 

Date/time: 

Relinquished  by: 

Received  by: 

Date/time: 

Relinquished  by: 

Received  by: 

Date/time: 

Dispatched  by: 

Date/time:  Received  for  Laboratory  by:  Date/time: 

Method  of  Sample  Transport: 

Shipper: 

Phone  No.: 

Tracking  No.: 

Sampler; 

Signature: 
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4  Sample  Analysis 


4. 1  Laboratory  Contact  List 


Analysis 

Laboratory 

Physical  Address 

Contact  Person 

Phone 

Pathogens 

Chemical 

Chemical 

Radiological 

CW  Agents 
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4.2  General  Approach  for  Analysis  of  Unknowns  in  Water 


, _ i 

Analysis  Complete. 
Report  Results. 


NO 
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4.3  General  Classes  of  Chemicals,  Analyte  Groups,  and  Example  Contaminants 


Chemical 

types 

Analytical  Group 

Example  Contaminants* 

Organic 

Volatiles 

Acetone,  acrylonitrile,  chloroform,  methyl  f-butyl  ether, 
tetrachloroethene,  toluene. 

Semivolatiles 

Organophosphates  (e.g.,  malathion,  mevinphos,  dichlorvos,  etc.), 
cyanazine,  chlorinated  insecticides,  chlordane,  pentachlorophenol 

Non-volatiles 

Sodium  trifluroacetates,  surfactants 

Carbamate  compounds 

Aldicarb,  carbofuran,  oxamyl 

Quaternary  nitrogen  compounds 

Diquat,  paraquat 

Pharmaceuticals 

Nicotine,  illicit  drugs 

Inorganic 

Trace  metals 

Mercury,  lead,  cobalt 

Nonmetals 

Arsenic  salts 

Organometallics 

Organomercury  compounds 

Cyanides 

Cyanides 

Cyanide  salts,  cyanogen  chloride 

Radionuclides 

Radiologicals 

Cesium-137,  Cobalt-60,  Strontium-92 

CW  Agents 

Schedule  1  only 

(e.g.,  VX,  sarin,  nitrogen  and  sulfur  mustards,  Lewsites) 

*  Not  every  contaminant  in  a  particular  analytical  group  is  listed  in  this  column. 


4.4  General  Classes  of  Pathogens,  Specific  Organisms,  and  Select  Agent  Status 


Pathogen  general  class 

Organism 

Select  Agent* 

Bacteria  (non-spore  forming) 

Brucella  spp. 

Yes 

Burkholderia  pseudomallerei 
Campylobacter  spp. 

E.  coli  0157:H7 

Yes 

Francisella  tularensis 

Salmonella  spp. 

Shigella  spp. 

Vibrio  cholerae 

Yes 

Yersinia  pestis 

Yes 

Bacteria  (spore  forming) 

Bacillus  anthracis 

Yes 

Clostridium  botulinum  A 

Yes 

Bacteria  (Rickettsia) 

Coxiella  burnetii 

Yes 

Protozoa 

Cryptosporidium  parvum 
Entamoeba  histolytica 

Giardia  intestinalis 

Toxoplasma  gondii 

Viruses 

Enteroviruses 

Hepatitis  A 

Hepatitis  E 

Noroviruses 

Rotavirus 

Variola 

Yes 

VEE 

Yes 

VHE 

Yes 

*  See  http://www.cdc.gov/od/sap/docs/salist.pdf 
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5  Response  Actions 

5. 1  Decision  Tree  for  Containment  Options 
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5.2  Decision  Tree  for  Pubiic  Notification 
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5.3  Contaminant  Characterization  and  Transport  Worksheet 


INSTRUCTIONS 

The  purpose  of  this  worksheet  is  to  heip  organize  information  that  wiii  iead  to  the  identification  of  the 
contaminant  to  faciiitate  decisions  on  appropriate  operationai  responses  and  provide  more  accurate 
information  for  pubiic  communication/notification.  Contaminant  identification  wiii  most  iikeiy  first  be  a 
presumptive  identification  foiiowed  by  more  iengthy  procedures  to  verify  the  identity  of  the  contaminant. 
White  vaiidated  anaiyticai  resuits  are  typicaiiy  the  most  reiiabie  means  of  contaminant  identification,  other 
information  coiiected  during  the  threat  evaluation  and  site  characterization  may  provide  vaiuabie 
insight  regarding  the  identity  of  the  contaminant. 

SITE  CHARACTERIZATION/THREAT  EVALUATION  SUMMARY 

Describe  the  contaminant's  odor,  if  appiicable.  _ 

Describe  the  reported  taste  of  the  contaminant,  if  applicabie. _ 

Caution:  Do  NOT  taste  the  water. 

What  was  the  physicai  form  of  the  contaminant? 

□  Solid  □  Liquid  □  Gas 

□  Slurry  □  Powder  □  Granules 

□  Other  _ 

What  color  was  the  contaminant? _ 

Summarize  additional  information  obtained  during  site  characterization/threat  warning  that  is  relevant  to 
contaminant  identification.  _ 


Summarize  the  on-line  monitoring  data,  consumer  complaints,  or  witness  accounts  that  are  relevant  to 
contaminant  identification.  _ 


Field  Analysis  Summary 

Summarize  the  results  of  the  field  analysis  for  the  following  parameters: 

Radiation _ 

Chlorine  residual _ 

pH,  conductivity _ 

Cyanide _ 

Volatile  chemicals _ 

Chemical  weapons _ 

Biotoxins _ 

Pathogens _ 

Other  _ 
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Public  Health  Information 


Have  death  or  disease  in  the  popuiation  been  reported?  □  Yes  □  No  □  Unknown 

Type/symptoms _ 

Is  there  information  on  unusual  sales  of  pharmaceutical  supplies  (e.g.,  diarrhea  medication)? _ 

Number  of  people  affected  _ 

Number  of  fatalities  _ 

Location/area  affected  _ 


Was  an  epidemiological  investigation  conducted?  □  Yes  □  No  □  Unknown 

Results  _ 


Was  a  clinical  investigation  conducted?  □  Yes  □  No  □  Unknown 

Results  _ 


Is  the  contaminant  acutely  toxic  and  what  are  the  acute  effects?  □  Yes  □  No  □  Unknown 
Describe  _ 

LABORATORY  ANALYSIS  SUMMARY 

Results  of  analysis _ 

Reporting  units _ 

Analytical  method _ 

Minimum  reporting  level _ 

Precision  (relative  standard  deviation) _ 

QA/QC  (e.g.,  recovery  of  matrix  spikes,  standard  checks,  etc.) _ 

Summarize  additional  information  obtained  during  laboratory  analysis  that  is  relevant  to  contaminant 
identification. 
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CONTAMINANT  CHARACTERISTICS 


What  is  the  class  of  the  contaminant? 

□  Biological  □  Chemical  □  Radiological 

□  Unknown  _ 


Can  any  conclusions  regarding  the  contaminant  properties  be  made?  (Place  an  ‘X’  in  the  appropriate 
column) _ _ _ _ _ 


Yes 

No 

Unk 

Comment/Additional  Information 

Is  the  contaminant  susceptible  to 
disinfection  or  chemical  oxidation? 

Does  the  contaminant  hydrolyze  into 
less  toxic  products? 

Does  the  contaminant  hydrolyze  into 
more  toxic  products? 

What  are  pKa  values  for  chemicals? 

Is  the  contaminant  water  soluble? 

Does  the  contaminant  have  a 
discernable  taste,  odor,  or  color? 

Is  the  contaminant  volatile  or  semi¬ 
volatile? 

Does  the  contaminant  impact  the  pH? 

Does  the  contaminant  impact 
conductivity? 

Does  the  contaminant  impact  other 
water  quality  parameters? 

Does  the  contaminant  react  with 
certain  disinfectants  (i.e.,  chlorine, 
chloramines,  etc.)? 

What  is  the  contaminant’s  half  life? 

Contaminant  Public  Health  Effect  Information 

What  are  the  primary  routes  of  exposure? 

□  Ingestion  □  Inhalation  □  Dermal  Contact 

□  Unknown _ 

What  are  the  acute  health  effects  for  the  exposure  routes  identified?  _ 


What  is  the  contaminant’s  LD50/ID50? 


What  is  the  length  of  time  to  first  onset  of  symptoms  after  exposure? 


What  are  the  chronic  health  effects  associated  with  exposure  to  the  contaminant? 
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Does  the  contaminant  have  a  method  of  secondary  transmission? 

□  Yes  □  No  □  Unknown 

Describe  _ 

Is  an  approach  avaiiabie  to  prevent  undesirabie  heaith  effects  from  the  contaminant? 

□  Yes  □  No  □  Unknown 

Describe  _ 

Are  there  treatments  avaiiabie  for  individuals  exposed  to  the  contaminant? 

□  Yes  □  No  □  Unknown 

Describe  _ 

Are  health  standards  for  the  contaminant  available? 

□  Yes  □  No  □  Unknown 

Describe  _ 

By  which  exposure  route(s)? 

□  Ingestion  □  Inhalation 

□  Dermal  □  Ocular 

List  the  levels  for  each  exposure  route. 


Contaminant  Treatment  Information 


Treatment  Types 

Could  be  used  to 
treat  the 
contaminant? 

Degradation  products 
formed  as  a  consequence 
of  treatment 

Rating  of  effectiveness 
(poor,  fair,  good)  of  percent 
effectiveness 

Lime  softening 

□  Yes 

□  No 

Reverse  osmosis 

□  Yes 

□  No 

Standard  chlorination 

□  Yes 

□  No 

Enhanced 

chlorination 

□  Yes 

□  No 

Standard  filtration 

□  Yes 

□  No 

Enhanced  filtration 

□  Yes 

□  No 

Membrane  filtration 

□  Yes 

□  No 

Nanofiltration 

□  Yes 

□  No 

Electrodialysis 

□  Yes 

□  No 

Cation  exchange 

□  Yes 

□  No 

resin 

Anion  exchange  resin 

□  Yes 

□  No 

Activated  alumina 

□  Yes 

□  No 

Chloramine 

□  Yes 

□  No 

Chlorine  dioxide 

□  Yes 

□  No 

Standard  UV 

□  Yes 

□  No 

Enhanced  UV 

□  Yes 

□  No 

Standard  ozone 

□  Yes 

□  No 

Enhanced  ozone 

□  Yes 

□  No 

Standard  GAC 

□  Yes 

□  No 

Enhanced  GAC 

□  Yes 

□  No 

Standard  air  stripping 

□  Yes 

□  No 

Enhanced  air 
stripping 

□  Yes 

□  No 

Other  Methods 

□  Yes 

□  No 
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Access  to  contaminant  information  (effects  and  properties) 


In-house  information 
Contact/phone  no. 
Internal  database 


Public  Health  officials 
Contact/phone  no. 
Web  site/database 


US  EPA  Water  Contaminant  Information  Tool 

Web  site/access  code _ 

•  US  EPA  water  contaminant  information  tool  (WCIT). 

•  US  ERA’S  List  of  Drinking  Water  Contaminants  &  MCLs: 
http://www.epa.qov/safewater/mcl.html#mcls. 

•  Agency  for  Toxic  Substances  and  Disease  Registry  (ATSDR):  www.atsdr.cdc.qov. 

•  CDC  Emergency  Preparedness  and  Response:  www.bt.cdc.qov. 

•  Recognizing  Waterborne  Disease  and  the  Health  Effects  of  Water  Pollution:  A  Physician  On-line 
Reference  Guide:  www.WaterHealthConnection.orq. 

•  Physician  Preparedness  for  Acts  of  Water  Terrorism: 
www.waterhealthconnection.orq/bt/index.asp. 

•  Registry  of  Toxic  Effects  of  Chemical  Substances  (RTECS):  www.cdc.qov/niosh/rtecs.html. 

•  Risk  Assessment  Information  System  (RAIS),  which  contains  information  taken  from  US  EPA's 
Integrated  Risk  Information  System  (IRIS),  the  Health  Effects  Assessment  Summary  Tables 
(HEAST-rad  HEAST-nonrad),  US  EPA  Peer  Reviewed  Toxicity  Values  (PRTVs)  Database,  and 
other  information  sources:  http://risk.lsd.ornl.qov/index.shtml. 

•  United  States  Army  Medical  Research  Institute  of  Infectious  Diseases  (USAMRIID)  Medical 
Management  of  Biological  Casualties  Handbook: 
http://www.usamriid.armv.mil/education/bluebook.html. 

•  WHO:  www.who.int/search/en/. 

•  WHO’s  “Public  health  response  to  biological  and  chemical  weapons:’’ 
www.who.int/csr/delibepidemics/biochemquide/en/index.html. 

CONTAMINANT  TRANSPORT 

Summarize  what  is  known  regarding  the  location  of  contaminant  introduction. 


How  much  material  was  used _ [lbs.,  tons,  gal,  etc.) 

How  was  it  added?  □  Single  dose  □  Overtime  □  Unknown 

Time  period  of  suspected  contaminant  introduction.  _ 

Elapsed  time.  _ 

Method  of  estimating  the  spread. 

□  Manual  calculations  □  Hydraulic  model  □  Water  flow  analysis 

□  GIS  □  Field  analysis  □  Areas  of  customer  complaints 

□  Areas  of  people  with  health-related  symptoms 

□  Other  _ 

Estimate  the  contaminated  area.  _ 

Estimate  the  population  affected. _ 
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Identify  any  customers  with  speciai  needs  that  are  within  the  affected  area. 

□  Criticai  Care  Faciiities 

□  Hospitais  □  Ciinics 

□  Nursing  Homes  □  Diaiysis  Centers 

□  Other  _ 

□  Schoois 

□  Day  Care  Faciiities 

□  Businesses 


□ 

Food  and  Beverage  Manufacturers 

□  Commerciai  Ice  Manufacturers 

□ 

Restaurants 

□  Agricultural  Operations 

□ 

Power  Generation  Faciiities 

□ 

Other 

SIGNOFF 

Name  of  person  compieting  form 

Print  name  _ 

Signature  _  Date/Time: 
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5.4  Public  Health  Response  Action  Worksheet 


INSTRUCTIONS 

The  purpose  of  this  form  is  to  heip  organize  information  to  aid  in  the  evaiuation  of  containment  options 
and  pubiic  notification  options.  The  objectives  of  pubiic  heaith  response  actions  (operationai  and  pubiic 
notification)  are  to  prevent  or  iimit  pubiic  exposure  to  potentiaiiy  contaminated  water  by  either  restricting 
further  propagation  of  the  contaminant  through  the  distribution  system  or  restricting  use  of  the  water 
through  pubiic  notification.  This  worksheet  assumes  that  the  “Contaminant  Characterization  and 
Transport  Worksheet”  in  Section  5.3  has  been  compieted  to  the  extent  possibie. 

ASSESSMENT  OF  PUBLIC  HEALTH  IMPACT 

Identity  of  the  contaminant  □  Suspected  □  Known  □  Unknown 

Describe  _ 


Contaminant  properties  (if  known): 

Toxic  or  infectious  dose  (LD50/ID50):  _ 

Route  of  exposure: 

□  Ingestion  □  Inhalation  □  Dermal  Contact 

□  Other  _ 

Symptoms  of  exposure  to  high  dose:  _ 

Symptoms  of  exposure  to  low  dose:  _ 

Other:  _ 


EVALUATION  OF  CONTAINMENT  OPTIONS 

Describe  the  location  and  extent  of  the  contaminated  area. 


Containment  options 

□  Valve  closures  □  Reverse  flow  conditions  □  By-pass 

□  Isolate  zone(s) 

□  Other _ 

Critical  equipment  within  contaminated  area 

□  System  equipment  □  Zones  □  Pump  stations 

□  Hydrants  □  Other _ 

Customers  with  special  needs  within  contaminated  area 

□  Critical  Care  Facilities 

□  Hospitals 

□  Nursing  Homes 

□  Other  _ 

□  Schools 

□  Businesses 

□  Food  and  Beverage  Manufacturers 

□  Restaurants 

□  Power  Generation  Facilities 

□  Other  _ 


□  Commercial  Ice  Manufacturers 

□  Agricultural  Operations 


□  Clinics 

□  Dialysis  Centers 
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Effectiveness  of  containment  options 

□  Complete  contaminant  isolation  □  Reduction  in  spread  of  contaminant 

□  Unknown  □  Other _ 

Is  containment  expected  to  provide  adequate  public  health  protection? 

□  Yes  □  No  □  Unknown 

Timeiine  for  impiementation  of  containment  options 

Containment  procedures  to  begin:  _ 

Containment  procedures  to  end:  _ 


EVALUATiON  OF  PUBLiC  NOTiFiCATiON  OPTiONS 

Is  public  notification  necessary?  □  Yes  □  No 

Coiiaboration  Agencies  (identified  in  Pubiic  Heaith  Response  Pian  and  Utiiity’s  ERP) 

□  Public  health  agencies  □  Police  departments  □  Fire  departments 

□  Hospitals/clinics  □  Laboratories  □  Drinking  water  primacy  agency 

□  Regional  Poison  Control  Center 

□  Other _ 


Type  of  notification  (Foiiow  steps  shown) 


Is  the  contaminant  known?  □ 

If  no,  issue  a  “  Do  Not  Use”  notice. 

-  If  yes,  is  boiling  effective  and  advisable?  □ 

If  yes,  issue  a  “Boil  Water”  notice. 

-  -  If  no  or  unknown,  is  there  a  risk  of  dermal  or  inhalation  exposure?  □ 

If  no,  issue  a  “Do  Not  Drink”  notice. 

If  yes  or  unknown,  issue  a  “  Do  Not  Use”  notice. 


Yes 

□ 

No 

Yes 

□ 

No 

□ 

Unknown 

Yes 

□ 

No 

□ 

Unknown 

Content  of  pubiic  notification 

□  Has  the  contamination  incident  been  confirmed? 

□  Is  the  contaminant  known? 

□  If  yes,  identity  of  the  contaminant  _ 

□  Characteristics  of  the  contaminant  _ 

□  Restrictions  on  use  _ 

□  Ingestion  exposure  □  Inhalation  exposure  □  Dermal  exposure 

□  Exposure  symptoms  _ 

□  Medical  treatments  _ 

□  Transmission  mode  (if  biological)  _ 

□  Duration  of  restriction  _ 

□  Alternate  water  supply  _ 

□  Additional  instructions  to  consumers _ 

□  Other  information  about  the  incident  _ 

□  Other  _ 


□  Yes  □  No 

□  Yes  □  No 
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Notification  to  customers  with  speciai  needs 

□  Critical  Care  Facilities 

□  Hospitals  □  Clinics 

□  Nursing  Homes  □  Dialysis  Centers 

□  Other  _ 

□  Schools 

□  Businesses 

□  Food  and  Beverage  Manufacturers  □  Commercial  Ice  Manufacturers 

□  Restaurants  □  Agricultural  Operations 

□  Power  Generation  Facilities 

□  Other  _ 

Are  there  subpopulations  that  will  be  affected  at  a  greater  rate  than  general  population? 

□  Yes  □  No  □  Unknown 

Describe _ 

Notification  to  consecutive  system. 

□  Yes  □  No  □  Not  Applicable 

Method  of  dissemination 


□ 

Broadcast  media  (radio  and  television) 

□ 

Government  access  channels 

□ 

Web  site 

□ 

Listserve  email 

□ 

Newspaper 

□ 

Letters  by  mail 

□ 

Newsletters  (water  utility  or  partner  organizations) 

□ 

Phone  banks 

□ 

Broadcast  phone  messages 

□ 

Broadcast  faxes 

□ 

Posting  in  conspicuous  locations 

□ 

Mass  distribution  through  partners 

□ 

Hand  delivery 

□ 

Door-to-door  canvassing 

□ 

Town  hall  meetings 

□ 

Conference  calls 

□ 

Other 

Notification/restriction  timeiine 

Notification/restriction  to  begin: 
Notification/restriction  to  end: 


ALTERNATE  WATER  SUPPLY  NEEDS 

Is  an  alternate  water  supply  needed? 

□  Drinking  water  □  Fire  fighting 

□  Other  _ 


Where  can  customers  obtain  the  alternate  water  supply? 

□  Bottled  water  provided  by  local  government  agencies 

□  Bottled  water  provided  by  local  retailers 

□  Bulk  water  provided  by  certified  water  haulers 

□  Bulk  water  transported  or  provided  by  military  assets 

□  Bulk  water  providing  by  neighboring  water  utilities 

□  Water  treated  at  plant  and  hauled  to  distribution  centers  (i.e.,  in  the  case  of  distribution  system 
contamination) 

□  Other 
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What  customers  with  special  needs  should  be  notified  of  the  alternate  water  supply  availability? 

□  Critical  Care  Facilities 

□  Hospitals  □  Clinics 

□  Nursing  Homes  □  Dialysis  Centers 

□  Other  _ 

□  Schools 

□  Businesses 

□  Food  and  Beverage  Manufacturers 

□  Restaurants 

□  Power  Generation  Facilities 

□  Other  _ 


□  Commercial  Ice  Manufacturers 

□  Agricultural  Operations 


SIGNOFF 

Name  of  person  completing  form 

Print  name  _ 

Signature  _  Date/Time: 
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6  Appendices 

6. 1  Critical  System  Information  Checklist 

□  Population  Served  and  Service  Connections 

□  Distribution  Network  Map  (including  pressure  zones) 

□  Pressure  Zone  Map 

□  Treatment  Process  Flow  Diagram 

□  Chlorination  Stations  (location  and  quantity  of  chlorine  on  site) 

□  Chemical  Handling  and/or  Storage  Facilities  and  Release  Impact  Analysis 

□  Booster  Pump  Stations  (location,  capacity,  and  power  requirements) 

□  Supervisory  Control  and  Data  Acquisition  systems 

□  Site  Staffing  Rosters  and  Employee’s  Duties  and  Responsibilities 

□  Vulnerability  Assessments 

□  Backup  Equipment  and  Power  Generation 
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6.2  Information  Resources 

•  Agency  for  Toxic  Substances  and  Disease  Registry  (ATSDR):  www.atsdr.cdc.gov. 

•  AOAC.  2003b.  “Rapid  Test  Kits  Test  Kit  Database” 
http://www.aoac.org/testkits/TKDATA2.HTM. 

•  CDC  Emergency  Preparedness  and  Response:  www.bt.cdc.gov. 

•  CDC.  2003f.  “List  of  Select  Biological  Agents”  http://www.cdc.gov/od/sap/docs/salist.pdf. 

•  CWC.  2003b.  “The  Chemical  Weapons  Convention  -  A  Quick  Guide,  CWC-002” 

http://www.cwc.aov/lndustrv  Outreach/Publications/002/cwc-b0001  html. 

•  FEMA,  Hazardous  Materials  Guide  for  First  Responders,  http://www.usfa.fema.gov/fire- 
service/hmgfr3  .cfm 

•  Physician  Preparedness  for  Acts  of  Water  Terrorism: 
www.waterhealthconnection.org/bt/index.asp. 

•  Recognizing  Waterborne  Disease  and  the  Health  Effects  of  Water  Pollution:  A  Physician  On-line 
Reference  Guide:  www.waterhealthconnection.org. 

•  Registry  of  Toxic  Effects  of  Chemical  Substances  (RTECS):  www.cdc.gov/niosh/rtecs.html. 

•  Risk  Assessment  Information  System  (RAIS),  which  contains  information  taken  from  the  US 
EPA  Integrated  Risk  Information  System  (IRIS),  the  Health  Effects  Assessment  Summary  Tables 
(HEAST-rad  HEAST-nonrad),  US  EPA  Peer  Reviewed  Toxicity  Values  (PRTVs)  Database,  and 
other  information  sources:  http://risk.lsd.ornl.gov/index.shtml. 

•  US  Army  Medical  Research  Institute  of  Infectious  Diseases  (USAMRIID)  Medical  Management 
of  Biological  Casualties  Handbook:  http://www.usamriid.armv.mil/education/bluebook.html. 

•  US  Army.  2002.  “Toxic  Chemical  Agent  Safety  Standards” 
http://www.usapa.armv.mil/pdffiles/p385  61.pdf. 

•  US  Coast  Guard.  2001.  “Chemical  Hazards  Response  Information  System” 
http://www.chrismanual.com. 

•  US  EPA’s  List  of  Drinking  Water  Contaminants  &  Maximum  Contaminant  Levels  (MCLs): 
http://www.epa.gOv/safewater/mcl.html#mcls. 

•  US  EPA.  2000.  “EPA  Radiological  Emergency  Response  Plan” 
http://www.epa.gOv/radiation/rert/docs/rerp-l-00.pdf. 

•  US  EPA.  2003c.  “EPA  Environmental  Technology  Verification  Home”  http://www.epa.gov/etv/. 

•  US  EPA.  Undated  c.  Compendium  of  Environmental  Testing  Laboratories. 
http://www.epa.gov/compendium 

•  US  National  Library  of  Medicine.  2001.  Toxicology  Tutor  I  -  Basic  Principles.  May  14. 
http://www.sis.nlm.nih.gov/ToxTutor/Toxl/al2.htm 

•  WaterlSAC,  which  contains  information  on  contaminants  including  various  contaminant  fact 
sheets  as  well  as  the  United  Kingdom  Water  Industry  Research  (UKWIR)  database: 
www.waterisac.org. 

•  WHO’s  “Public  health  response  to  biological  and  chemical  weapons” 
www.who.int/csr/delibepidemics/biochemguide/en/index.html. 

•  WHO.  2001.  “Health  Aspects  of  Biological  and  Chemical  Weapons” 
http://www.who.int/emc/pdfs/BIOWEAPONS  FULL  TEXT2.pdf 
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6.3  Threat  Management  Matrices 


This  section  presents  a  “contamination  threat  management  matrix”  for  each  of  the  threat 
warnings  described  in  Section  2.2.  Each  matrix  is  a  tabular  summary  that  lists  the  following  at 
the  ‘possible,’  ‘credible,’  and  ‘confirmatory’  stages  of  the  threat  evaluation: 

•  Information  considered  during  the  threat  evaluation. 

•  Factors  considered  during  the  threat  evaluation. 

•  Potential  response  actions. 


6.3.1  Security  Breach 


■ 

fHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

Information 

•  Location  of  security  breach. 

•  Time  of  security  breach. 

•  Information  from  alarms. 

•  Observations  when  security 
breach  was  discovered. 

•  Additional  details  from  the 
threat  warning. 

•  Results  of  site  characterization  at 
location  of  security  breach. 

•  Previous  security  incidents. 

•  Real  time  water  quality  data  from 
the  location  of  security  breach. 

•  Input  from  local  law  enforcement. 

•  Results  of  sample  analysis. 

•  Contaminant  information. 

•  Results  of  site  characterization 
at  other  investigation  sites. 

•  Input  from  primacy  agency 
and  public  health  agency. 

Evaluation 

•  Was  there  an  opportunity  for 
contamination? 

•  Has  normal  operational 
activity  been  ruled  out? 

•  Have  other  “harmless” 
causes  been  ruled  out? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  this  security  breach  similar  to 
previous  security  incidents? 

•  Does  other  information  (e.g., 
water  quality)  corroborate  threat? 

•  Does  law  enforcement  consider 
this  a  credible  threat? 

•  Were  unusual  contaminants 
detected  during  analysis?  Do 
they  pose  a  risk  to  the  public? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  contamination  indicated  by  a 
“preponderance  of  evidence?” 

Notifications 

•  Notifications  within  utility. 

•  Local  law  enforcement 
agencies. 

•  Drinking  water  primacy  agency. 

•  State/local  public  health  agency. 

•  FBI. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Isolate  affected  area. 

•  Initiate  site  characterization. 

•  Estimate  spread  of  suspected 
contaminant. 

•  Consult  external  information 

sources. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Analyze  samples. 

•  Perform  site  characterization  at 
additional  investigation  sites. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

Security  breaches  may  be  the  most  common  type  of  threat  warning  encountered  by  a  utility  since 
they  may  result  from  trespassing,  vandalism,  theft,  or  failure  to  re-secure  facilities  following 
legitimate  activities.  The  purpose  of  the  threat  evaluation  under  this  scenario  is  to  distinguish 
between  these  more  frequent,  yet  relatively  harmless  security  breaches,  and  those  few  that  might 
be  considered  ‘credible’  contamination  threats. 

At  the  ‘possible’  stage  of  the  threat  evaluation,  information  about  the  security  breach  will  be 
available.  Specifically,  the  location  of  the  security  breach  will  be  known,  which  will  likely  be 
established  as  the  initial  investigation  site.  Other  information  may  be  available  from  alarms 
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(including  surveillance  footage),  which  may  help  to  establish  the  time  of  the  security  breach. 

The  evaluation  at  this  stage  should  consider  whether  or  not  there  was  an  opportunity  for 
contamination  at  the  site  of  the  security  breach.  Furthermore,  “normal”  activity  should  be 
considered  and  investigated  at  this  stage  as  a  potential  cause  of  the  security  breach  (e.g.,  was  a 
utility  crew  recently  at  the  site  and  potentially  forgot  to  re-secure  the  area?).  Potential  response 
actions  to  a  ‘possible’  threat  may  include  isolating  areas  of  the  system  that  could  be  affected, 
initiating  site  characterization  activities  to  collect  more  information  in  support  of  the  threat 
evaluation,  and  initiating  the  process  to  estimate  the  spread  of  the  suspect  water  through  the 
system. 

Information  that  may  be  available  at  the  ‘credible’  stage  includes  the  results  of  site 
characterization,  an  assessment  of  previous  security  incidents,  real-time  water  quality  data  in  the 
area  of  the  security  breach,  and  an  assessment  of  the  threat  by  law  enforcement.  The  evaluation 
at  this  stage  will  consider  whether  or  not  signs  of  contamination  were  discovered  during  site 
characterization,  including  unusual  results  from  field  testing  or  unusual  observations  during  the 
site  investigation.  Consideration  should  also  be  given  to  whether  or  not  the  new  information 
available  at  this  stage  corroborates  the  information  about  the  threat.  If  the  threat  is  determined  to 
be  ‘credible,’  response  actions  may  include  measures  to  limit  or  prevent  exposure  of  the  public  to 
the  suspect  water,  such  as  public  notification.  Actions  taken  to  continue  the  investigation  at  this 
point  may  include  analysis  of  samples  collected  from  the  site,  continued  site  characterization 
activities,  and  an  analysis  to  estimate  the  spread  of  the  contaminant. 

The  new  information  available  at  the  confirmatory  stage  may  include  the  results  from  laboratory 
analysis,  including  QA/QC  data  to  support  the  interpretation  of  the  results.  If  a  specific 
contaminant  is  identified,  then  additional  information  about  that  contaminant  can  be  used  to 
further  evaluate  the  nature  of  the  threat  as  well  as  implications  to  public  health.  The  findings  of 
continued  site  characterization  activities  may  also  help  to  confirm  the  incident.  The  basis  for 
confirming  a  contamination  incident  can  be  analytical  results  that  identify  a  specific  contaminant 
or  other  definitive  evidence  that  a  contaminant  is  present  in  the  water.  If  a  contaminant  has  been 
identified,  consideration  should  be  given  to  the  health  effects  associated  with  exposure  to  that 
contaminant.  It  may  be  necessary  to  revise  the  sampling  and  analysis  plans  if  a  contaminant  was 
not  positively  identified  through  laboratory  analysis  but  the  threat  is  still  deemed  ‘credible.’ 
Response  actions  potentially  initiated  once  a  contamination  incident  has  been  confirmed  include 
characterization  of  the  contaminated  area,  revision  to  public  health  protection  measures, 
provision  of  alternate  water  supplies,  and  planning  for  remediation  and  recovery  activities. 


66 


Interim  Final  -  August  2004 


6.3.2  Witness  Account 


■ 

fHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

Information 

•  Location  of  the  suspicious 
activity. 

•  Witness  account  of  the 
suspicious  activity. 

•  Additional  details  from  the 
threat  warning. 

•  Additional  information  from  the 
witness. 

•  Results  of  site  characterization  at 
location  of  suspicious  activity. 

•  Previous  security  incidents. 

•  Real  time  water  quality  data  from 
the  location  of  suspicious  activity. 

•  Input  from  local  law  enforcement. 

•  Results  of  sample  analysis. 

•  Contaminant  information. 

•  Results  of  site  characterization 
at  other  investigation  sites. 

•  Input  from  primacy  agency 
and  public  health  agency. 

Evaluation 

•  Was  there  an  opportunity  for 
contamination? 

•  Is  the  witness  reliable? 

•  Has  normal  operational 
activity  been  ruled  out? 

•  Have  other  “harmless” 
causes  been  ruled  out? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  the  suspicious  activity  similar 
to  previous  security  incidents? 

•  Does  other  information  (e.g., 
water  quality)  corroborate  threat? 

•  Does  law  enforcement  consider 
this  a  credible  threat? 

•  Were  unusual  contaminants 
detected  during  analysis?  Do 
they  pose  a  risk  to  the  public? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  contamination  indicated  by  a 
“preponderance  of  evidence?” 

Notifications 

•  Notifications  within  utility. 

•  Local  law  enforcement. 

•  Drinking  water  primacy  agency. 

•  State/local  public  health  agency. 

•  FBI. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Isolate  affected  area. 

•  Initiate  site  characterization. 

•  Estimate  spread  of  suspected 
contaminant. 

•  Consult  external  information 

sources. 

•  Interview  witness  for 
additional  information. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Analyze  samples. 

•  Perform  site  characterization  at 
additional  investigation  sites. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

From  the  perspective  of  the  threat  management  process,  a  threat  triggered  by  a  witness  account  is 
similar  to  one  triggered  by  a  security  breach.  One  of  the  few  significant  differences  is  the  use  of 
information  collected  directly  from  the  witness  throughout  the  evaluation,  particularly  during  the 
‘possible’  and  ‘credible’  stages  of  the  threat  evaluation.  The  reliability  of  the  witness  must  be 
considered  when  making  these  determinations,  and  additional  evidence  collected  during  the 
investigation  should  be  evaluated  to  determine  whether  or  not  it  corroborates  the  witness 
account. 
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6.3.3  Direct  Notification  by  Perpetrator 


■ 

fHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

Information 

•  Transcript  of  phone  (or 
written)  threat. 

•  The  who,  what,  where, 
when,  and  why  of  the  threat. 

•  Additional  details  from  the 
threat  warning. 

•  Vulnerability  assessment. 

•  Law  enforcement  assessment. 

•  Primacy  agency  assessment. 

•  Previous  threats  at  this  utility  or 
other  utilities. 

•  Results  of  site  characterization  at 
selected  investigation  sites. 

•  Real  time  water  quality  data. 

•  Reports  from  ISAC,  EPA,  etc. 

•  FBI  assessment. 

•  Results  of  sample  analysis. 

•  Contaminant  information. 

•  Results  of  site  characterization 
at  other  investigation  sites. 

•  Input  from  primacy  agency 
and  public  health  agency. 

Evaluation 

•  Is  the  threat  feasible? 

•  Has  the  water  already  been 
contaminated? 

•  Is  the  location  known  or 
suspected? 

•  Is  the  identity  of  the 
perpetrator  known  or 
suspected? 

•  Have  there  been  personnel 
problems  at  the  utility? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Does  other  information  (e.g., 
water  quality)  corroborate  threat? 

•  Does  law  enforcement  consider 
this  a  credible  threat? 

•  Does  the  primacy  agency  consider 
this  a  credible  threat? 

•  Were  unusual  contaminants 
detected  during  analysis?  Do 
they  pose  a  risk  to  the  public? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  contamination  indicated  by  a 
“preponderance  of  evidence?” 

Notifications 

•  Notifications  within  utility. 

•  Local  law  enforcement. 

•  Drinking  water  primacy 
agency. 

•  FBI. 

•  State/local  public  health  agency. 

•  EPA  Criminal  Investigation 
Division. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Isolate  affected  area  if 
identified  in  the  threat. 

•  Identify  sites  and  initiate  site 
characterization. 

•  Consult  external  information 

sources. 

•  Gather  information  from  law 
enforcement  assessment. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Analyze  samples. 

•  Perform  site  characterization  at 
additional  investigation  sites. 

•  Estimate  spread  of  suspected 
contaminant. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

Threats  to  contaminate  the  water  made  via  direct  notification  by  a  perpetrator  need  to  be  taken 
seriously.  However,  the  majority  of  such  direct  threats  are  hoaxes  that  may  be  intended  to  cause 
panic  or  disruption,  gain  attention,  or  fulfill  a  personal  vendetta.  Thus,  the  focus  of  the  threat 
evaluation  for  this  type  of  threat  warning  is  to  identify  any  credible  threats  amongst  the  larger 
number  of  hoax  notifications.  In  any  case,  direct  threats  against  the  water  supply  should  be 
reported  to  local  law  enforcement. 

A  key  source  of  information  that  may  support  the  threat  evaluation  under  this  scenario  is 
provided  directly  by  the  perpetrator  making  the  threat.  In  the  case  of  a  phone  threat,  it  is 
important  to  collect  information  about  the  threat  from  the  caller  to  support  the  threat  evaluation. 
Similarly,  a  written  notification  should  be  carefully  reviewed  for  details  about  the  threat. 
Additional  information  collected  throughout  the  investigation  should  be  evaluated  against  the 
details  of  the  threat  notification,  and  it  corroborates  the  details  of  the  notification,  then  the  threat 
is  more  likely  to  be  deemed  ‘credible.’ 
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One  of  the  potential  challenges  in  managing  a  threat  triggered  by  direct  notification  from  a 
perpetrator  is  identification  of  an  investigation  site  that  will  be  the  focus  of  site  characterization 
activities.  Unless  a  location  is  named  in  the  threat,  it  will  be  necessary  to  use  other  information, 
such  as  that  derived  from  vulnerability  assessments  or  unusual  water  quality  data/consumer 
complaints,  to  identify  investigation  sites. 
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6.3.4  Unusual  Water  Quality  or  Consumer  Complaints 


Unusual  Water  Quality 


■ 

rHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

Information 

•  Unusual  water  quality  data. 

•  Baseline  water  quality  data. 

•  Real  time  water  quality  data. 

•  Operational  information 
corresponding  to  the  time  of 
the  unusual  water  quality. 

•  Results  of  site  characterization  at 
selected  investigation  sites. 

•  Previous  threat  warnings  triggered 
by  water  quality. 

•  Contaminant  information. 

•  Reports  of  consumer  complaints. 

•  Results  of  sample  analysis. 

•  Contaminant  information. 

•  Results  of  site  characterization 
at  other  investigation  sites. 

•  Input  from  primacy  agency 
and  public  health  agency. 

Evaluation 

•  Is  the  unusual  water  quality 
significantly  different  from 
an  established  baseline? 

•  Could  operational  changes 
be  the  cause? 

•  Could  changes  in  source 
water  quality  be  the  cause? 

•  Are  there  similar  results  at 
other  monitoring  locations? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  this  unusual  data  substantial 
different  from  other  water  quality 
episodes? 

•  Is  the  unusual  data  indicative  of  a 
specific  contaminant? 

•  Are  the  unusual  water  quality 
clustered  in  a  specific  area? 

•  Are  there  any  unusual  consumer 
complaints  in  the  area? 

•  Were  unusual  contaminants 
detected  during  analysis?  Do 
they  pose  a  risk  to  the  public? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  contamination  indicated  by  a 
“preponderance  of  evidence?” 

Notifications 

•  Notifications  within  utility. 

•  Drinking  water  primacy  agency. 

•  State/local  public  health  agency. 

•  Local  law  enforcement. 

•  FBI. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Identify  sites  and  initiate  site 
characterization. 

•  Begin  analysis  of  available 
water  quality  data. 

•  Investigate  unusual 
consumer  complaints. 

•  Consult  external  information 

sources. 

•  Estimate  affected  area  and  isolate 
if  possible. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Analyze  samples. 

•  Perform  site  characterization  at 
additional  investigation  sites. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

Consumer  Complaint 


'' 

rHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

•  Compilation  of  consumer 

•  Results  of  site  characterization  at 

•  Results  of  sample  analysis. 

complaints,  including 

selected  investigation  sites. 

•  Contaminant  information. 

geographic  distribution. 

•  Summary  of  historic  consumer 

•  Results  of  site  characterization 

•  Recent  water  quality  data 

complaints. 

at  other  investigation  sites. 

s 

;_i 

that  may  be  associated  with 

•  Results  of  consumer  interviews. 

•  Input  from  primacy  agency 

l-H 

complaints. 

•  Operational  information 
corresponding  to  the  time  of 
the  unusual  complaints. 

•  Contaminant  information. 

and  public  health  agency. 
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Evaluation 

•  Are  the  complaints  unusual? 

•  Could  operational  changes 
be  the  cause? 

•  Could  changes  in  source 
water  quality  be  the  cause? 

•  Are  the  complaints  clustered 
in  a  specific  area? 

•  Are  complaints  from 
habitual  complainers? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Are  other  consumers  in  the  area 
experiencing  similar  water 
quality? 

•  Are  the  unusual  complaints 
significantly  different  from  typical 
complaints? 

•  Are  the  complaints  indicative  of  a 
specific  contaminant? 

•  Is  there  anything  unusual  about 
the  water  quality  in  the  area? 

•  Were  unusual  contaminants 
detected  during  analysis?  Do 
they  pose  a  risk  to  the  public? 

•  Do  site  characterization  results 
reveal  signs  of  contamination? 

•  Is  contamination  indicated  by  a 
“preponderance  of  evidence?” 

Notifications 

•  Notifications  within  utility. 

•  Drinking  water  primacy  agency. 

•  State/local  public  health  agency. 

•  Local  law  enforcement  agency. 

•  FBI. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Identify  sites  and  initiate  site 
characterization. 

•  Begin  analysis  of  available 
water  quality  data. 

•  Interview  consumers  in  area 
with  high  numbers  of 
complaints. 

•  Consult  external  information 

sources. 

•  Estimate  affected  area  and  isolate 
if  possible. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Analyze  samples. 

•  Perform  site  characterization  at 
additional  investigation  sites. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

A  threat  warning  arising  from  unusual  water  quality  data  is  significantly  different  from  the 
other  threat  warnings  previously  discussed  and  thus  should  be  handled  differently  during  the 
threat  evaluation.  In  determining  whether  or  not  the  threat  is  ‘possible,’  it  is  necessary  to 
evaluate  the  anomalous  data  relative  to  an  established  baseline.  Furthermore,  it  is  important  to 
consider  operational  conditions,  or  potential  impacts  from  changing  source  water  quality  or 
distribution  system  blending  as  possible  explanations  for  the  unusual  water  quality  or  complaint. 
If  the  unusual  water  quality  data  is  determined  to  be  significantly  different  from  the  baseline,  and 
cannot  be  explained  by  other  factors,  then  t  contamination  may  be  considered  a  possibility. 

Presumably,  the  unusual  water  quality  data  will  be  associated  with  a  particular  location  in  the 
system,  which  will  help  in  the  identification  of  investigation  sites  that  will  be  the  focus  of  site 
characterization  activities.  At  this  stage,  it  is  important  to  verify  the  anomalous  water  quality 
data  through  additional  testing  using  independent  equipment.  For  example,  if  an  incident  was 
triggered  by  a  rapid  decrease  in  the  free  chlorine  residual,  as  detected  by  online  electrochemical 
monitors,  additional  testing  could  be  performed  with  colormetric  field  kits  to  confirm  the  results. 
Additional  rapid  field  testing  might  also  help  to  determine  the  bounds  of  the  affected  area. 
Furthermore,  specific  information  about  particular  contaminants  should  be  considered  at  the 
‘credible’  stage  as  it  might  be  used  to  identify  potential  contaminants  that  would  impact  the 
water  quality  parameter  with  anomalous  readings.  For  example,  contaminants  with  acidic 
functional  groups  might  result  in  reduced  pH. 
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6.3.5  Notification  by  Public  Health 


■ 

fHREAT  EVALUATION  STAGE  | 

Possible 

Credible 

Confirmatory 

Information 

•  Details  of  notification  from 
public  health  sector. 

•  Symptoms  of  disease  and 
causative  agent,  if  known. 

•  Contaminant  information. 

•  Geographic  distribution  of  disease 
or  death. 

•  Recent  water  quality  and 
operational  data. 

•  Reports  of  consumer  complaints. 

•  Contaminant  information. 

•  Results  of  site  characterization 
at  selected  investigation  sites. 

•  Results  of  sample  analysis. 

•  Contaminant  information. 

•  FBI  assessment. 

Evaluation 

•  Why  is  water  under 
investigation  as  a  possible 
source? 

•  Are  the  reported  symptoms 
consistent  with  exposure  to 
the  contaminant  via  water? 

•  If  causative  agent  is  known, 
is  it  stable  in  water? 

•  Is  the  geographic  pattern  of 
exposure  consistent  with  exposure 
to  contaminated  water? 

•  Is  there  a  recent  occurrence  of 
unusual  water  quality  data  or 
consumer  complaints? 

•  Does  additional  information  about 
the  potential  contaminant  indicate 
water  as  a  potential  source? 

•  Has  the  public  health  agency 
concluded  that  water  is  the 
cause  of  the  disease  or  deaths? 

•  Did  sample  analysis  detect  the 
causative  agent? 

•  Was  another  contaminant 
detected  during  sample 
analysis  that  could  be  the  cause 
of  the  disease  or  deaths? 

Notifications 

•  Notifications  within  utility. 

•  State/local  public  health 
agency. 

•  Drinking  water  primacy 
agency. 

•  FBI. 

•  Local  and  State  law  enforcement 
agencies. 

•  Emergency  response  agencies. 

•  National  Response  Center. 

•  Other  state  and  federal 
assistance  providers. 

Response 

•  Consult  with  public  health 
agency  and  primacy  agency. 

•  Consult  external  information 

sources. 

•  Estimate  affected  area  and  isolate 
if  possible. 

•  Implement  appropriate  public 
health  protection  measures. 

•  Plan  for  alternate  water  supply. 

•  Identify  sites  and  initiate  site 
characterization. 

•  Analyze  samples. 

•  Characterize  affected  area. 

•  Revise  public  health  protection 
measures  as  necessary. 

•  Provide  alternate  water  supply. 

•  Plan  remediation  activities. 

Notification  from  public  health  officials  regarding  a  potential  water  contamination  incident  is 
unique  in  that  individuals  have  been  exposed  to  a  harmful  substance  resulting  in  illness,  disease 
or  death  in  the  population.  The  threat  evaluation  in  this  case  may  be  part  of  a  larger 
epidemiological  investigation  to  determine  the  cause  of  disease.  It  is  critical  that  the  utility  work 
with  the  appropriate  public  health  officials  from  the  outset,  since  these  officials  will  likely  have 
information  critical  for  the  evaluation.  For  example,  they  may  know  or  suspect  the  causative 
agent  based  on  clinical  information.  This  knowledge,  in  conjunction  with  information  about  the 
properties  of  the  contaminant,  may  indicate  whether  or  not  contaminated  water  is  even  a 
possibility.  For  example,  if  the  causative  agent  is  known  to  immediately  break  down  into 
harmless  byproducts  upon  exposure  to  water,  then  the  possibility  of  contaminated  water  might  be 
dismissed. 

If  water  is  considered  a  possible  carrier  for  the  contaminant,  then  further  investigation  should  be 
conducted  to  determine  if  water  is  the  most  likely  carrier  of  the  contaminant  (i.e.,  analogous  to 
the  ‘credible’  stage  of  the  threat  evaluation).  Information  that  may  help  to  make  this 
determination  will  include  additional  findings  from  the  larger  epidemiological  investigation, 
geographic  distribution  of  exposure,  recent  water  quality  and  operational  data,  and  reports  of 
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consumer  complaints.  If  this  additional  information  indicates  that  water  contamination  is  likely, 
response  actions  would  likely  include  public  notification  and  sampling  for  the  contaminant.  The 
sampling  plan  developed  at  this  point  may  start  with  information  about  the  geographic 
distribution  of  exposure;  however,  consideration  must  be  given  to  the  latency  period  of  the 
disease,  which  could  be  from  minutes  to  weeks,  as  well  as  the  travel  time  within  the  system.  The 
objectives  of  sampling  and  analysis  at  this  point  would  include:  1)  confirming  the  presence  of  the 
contaminant  in  the  water;  2)  determining  if  the  contaminant  is  still  present;  and  3)  determining 
the  area  affected.  If  water  contamination  is  confirmed,  and  the  contaminant  is  still  present  in  the 
system,  it  will  be  necessary  to  begin  planning  for  remediation  and  recovery  efforts.  If  the 
contaminant  is  not  found,  extensive  sampling  would  likely  be  necessary  to  demonstrate  that  the 
contaminant  is  indeed  absent  from  the  system. 
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